f3aa2b23a67f4dbcce9fff7bb084e70127e3e0c4f2ab0f605487c570a7408960

Analysis

max time kernel
122s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
Size

311KB
MD5

1e47fa765a3ba96e50fb204baf7c2e8d
SHA1

fe03cbd4b95fae338ca7686c6e5e5a1309f54713
SHA256

6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf
SHA512

b76ec98f006ab559331ee1c76e8285e489dbdcca16756c64b7820e4374958fe9d110a888425e39d3353291c17024fcef6b398c68a28d953685224f68656618a0
SSDEEP

6144:h7Z5ZJygGwy4HZocAZHzdjFnfB12/b1i2gySW:p7iLV55nfB124NW

Score

9^/10

discovery spyware stealer

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral7/memory/2860-34-0x0000000006ED0000-0x000000000705C000-memory.dmp	Nirsoft

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral7/memory/2860-34-0x0000000006ED0000-0x000000000705C000-memory.dmp	WebBrowserPassView

Executes dropped EXE 1 IoCs

pid	Process
2860	sync.exe

Loads dropped DLL 1 IoCs

pid	Process
2328	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sync.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2736	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
Token: SeDebugPrivilege	2860	sync.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2220	1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	31
PID 1956 wrote to memory of 2220	1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	31
PID 1956 wrote to memory of 2220	1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	31
PID 1956 wrote to memory of 2220	1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	31
PID 1956 wrote to memory of 2328	1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	33
PID 1956 wrote to memory of 2328	1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	33
PID 1956 wrote to memory of 2328	1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	33
PID 1956 wrote to memory of 2328	1956	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	33
PID 2220 wrote to memory of 2704	2220	cmd.exe	35
PID 2220 wrote to memory of 2704	2220	cmd.exe	35
PID 2220 wrote to memory of 2704	2220	cmd.exe	35
PID 2220 wrote to memory of 2704	2220	cmd.exe	35
PID 2328 wrote to memory of 2736	2328	cmd.exe	36
PID 2328 wrote to memory of 2736	2328	cmd.exe	36
PID 2328 wrote to memory of 2736	2328	cmd.exe	36
PID 2328 wrote to memory of 2736	2328	cmd.exe	36
PID 2328 wrote to memory of 2860	2328	cmd.exe	37
PID 2328 wrote to memory of 2860	2328	cmd.exe	37
PID 2328 wrote to memory of 2860	2328	cmd.exe	37
PID 2328 wrote to memory of 2860	2328	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
"C:\Users\Admin\AppData\Local\Temp\6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sync" /tr '"C:\Users\Admin\AppData\Roaming\sync.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "sync" /tr '"C:\Users\Admin\AppData\Roaming\sync.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpDF38.tmp.bat""
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2736
- - C:\Users\Admin\AppData\Roaming\sync.exe
    "C:\Users\Admin\AppData\Roaming\sync.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDF38.tmp.bat

Filesize
148B

MD5
408a8db8e626cdf6909c2b897fe89ec2

SHA1
38d8828d21f2e456f9dda7b247602c6c95d11cce

SHA256
1e1afa18436c9d59c08265e5c532f47e1bc588fec3ecc60a1540020fdb58c352

SHA512
33513ac4a04d24589e1ed567bde2fdb58749cd213fa071ea2f4f2348e11898ad87b84fded51ebc8f005653246a9f9b0a8048497b63cfea7dc63ecdd891a91956

Download Submit
C:\Users\Admin\AppData\Roaming\sync.exe

Filesize
311KB

MD5
1e47fa765a3ba96e50fb204baf7c2e8d

SHA1
fe03cbd4b95fae338ca7686c6e5e5a1309f54713

SHA256
6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf

SHA512
b76ec98f006ab559331ee1c76e8285e489dbdcca16756c64b7820e4374958fe9d110a888425e39d3353291c17024fcef6b398c68a28d953685224f68656618a0

Download Submit
memory/1956-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

Filesize
4KB

Download
memory/1956-1-0x0000000000200000-0x0000000000254000-memory.dmp

Filesize
336KB

Download
memory/1956-2-0x0000000074A70000-0x000000007515E000-memory.dmp

Filesize
6.9MB

Download
memory/1956-12-0x0000000074A70000-0x000000007515E000-memory.dmp

Filesize
6.9MB

Download
memory/2860-16-0x0000000001230000-0x0000000001284000-memory.dmp

Filesize
336KB

Download
memory/2860-34-0x0000000006ED0000-0x000000000705C000-memory.dmp

Filesize
1.5MB

Download