Analysis

  • max time kernel
    154s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:10

General

  • Target

    4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe

  • Size

    3.3MB

  • MD5

    5b034c2b074c565a4c3d9f5c7e2d3118

  • SHA1

    0595e199c88b91019387b3a80dedfd0a72b69bea

  • SHA256

    4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d

  • SHA512

    bf4f3f9c54bf9a1a93786e6bf8ccbfa411cb23d02e4a1c5a56aeb583d7479ebbcca4f4330f7e30c184f454b37e8b4d3db494e9065cafdc9c3d69b8d281618f8d

  • SSDEEP

    98304:HRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/3UYd4q:Hkj8NBFwxpNOuk2U1d

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe
    "C:\Users\Admin\AppData\Local\Temp\4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Users\Admin\AppData\Local\Temp\QIr17WQ1At.exe
      "C:\Users\Admin\AppData\Local\Temp\QIr17WQ1At.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDRiYmYxZjMzZDAxOTZlOWE0ZmZhZTE4Nzc2OTBiZDAwMGM3ZjcyOGQ1NDYyNTJjZWQ0NWU2MGVjZmUyNWUwNGQuZXhl
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2432
        • C:\Windows\system32\sc.exe
          sc stop "SysMain"
          4⤵
          • Launches sc.exe
          PID:2004
        • C:\Windows\system32\sc.exe
          sc config "SysMain" start=disabled
          4⤵
          • Launches sc.exe
          PID:1416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\QIr17WQ1At.exe

    Filesize

    3.3MB

    MD5

    caca6e9e15cbb3de3ed760c6f2def7e1

    SHA1

    1bb885ea5d37c6c3cf975357202495399158eb00

    SHA256

    b924660cd47ac908f553fc8f78d13afc0b917044d82ae7c9d100fa5b0c8dc698

    SHA512

    c70389db96b1d2311ccb0c1730a8b139d097dfeb36437b5cb3b890d0fdcc21366844e3195fb5a684289c07744af9a7c435bb2133cfed0194e2224e86ea3af291

  • memory/2080-35-0x0000000002100000-0x000000000210A000-memory.dmp

    Filesize

    40KB

  • memory/2080-34-0x0000000002100000-0x000000000210A000-memory.dmp

    Filesize

    40KB

  • memory/2080-33-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-32-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-28-0x0000000002100000-0x000000000210A000-memory.dmp

    Filesize

    40KB

  • memory/2080-29-0x0000000002100000-0x000000000210A000-memory.dmp

    Filesize

    40KB

  • memory/2080-27-0x00000000020E0000-0x00000000020E6000-memory.dmp

    Filesize

    24KB

  • memory/2080-26-0x0000000002420000-0x0000000002492000-memory.dmp

    Filesize

    456KB

  • memory/2080-25-0x0000000002110000-0x0000000002142000-memory.dmp

    Filesize

    200KB

  • memory/2080-24-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-22-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-21-0x000000013F830000-0x000000013FB54000-memory.dmp

    Filesize

    3.1MB

  • memory/2832-6-0x000000001CF30000-0x000000001D368000-memory.dmp

    Filesize

    4.2MB

  • memory/2832-7-0x0000000000780000-0x0000000000784000-memory.dmp

    Filesize

    16KB

  • memory/2832-11-0x00000000020A0000-0x00000000020D2000-memory.dmp

    Filesize

    200KB

  • memory/2832-23-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

    Filesize

    9.9MB

  • memory/2832-10-0x00000000007B0000-0x00000000007B6000-memory.dmp

    Filesize

    24KB

  • memory/2832-9-0x000000001B980000-0x000000001BA1C000-memory.dmp

    Filesize

    624KB

  • memory/2832-8-0x00000000007A0000-0x00000000007A6000-memory.dmp

    Filesize

    24KB

  • memory/2832-12-0x0000000002260000-0x0000000002264000-memory.dmp

    Filesize

    16KB

  • memory/2832-0-0x000007FEF5F63000-0x000007FEF5F64000-memory.dmp

    Filesize

    4KB

  • memory/2832-5-0x0000000000750000-0x0000000000780000-memory.dmp

    Filesize

    192KB

  • memory/2832-4-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

    Filesize

    9.9MB

  • memory/2832-3-0x000007FEF5F63000-0x000007FEF5F64000-memory.dmp

    Filesize

    4KB

  • memory/2832-2-0x000000001BF80000-0x000000001C270000-memory.dmp

    Filesize

    2.9MB

  • memory/2832-1-0x000000013F2D0000-0x000000013F5F4000-memory.dmp

    Filesize

    3.1MB