Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/03/2025, 10:19
General
-
Target
c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b.exe
-
Size
615KB
-
MD5
0cccb7731df5885d0405e9243cc27186
-
SHA1
b4d00aac110acfbb3da657a57f3ba43c968f4c22
-
SHA256
c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b
-
SHA512
ff6c364decbd3ec6d9c291e670839ff2537e7914fbd7dd8e85a363270c6a8609f3c1b72edac482d11f8749a17b4c5c007cd4f5917c7ada66cbb0f2f36fbf3099
-
SSDEEP
12288:YXvoWzJMd1MOqctASMZ6upAbyXjARtxldrK7mfk:W5zGYTwuebeIHk
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Windows directory 1 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
-
Suspicious use of AdjustPrivilegeToken 55 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b.exe"C:\Users\Admin\AppData\Local\Temp\c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b.exe"C:\Users\Admin\AppData\Local\Temp\c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b.exe" -group=user -outputfile=C:\Windows\Temp\all_212.102.63.147_user.txt2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b.exe"C:\Users\Admin\AppData\Local\Temp\c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b.exe" -group=misc -outputfile=C:\Windows\Temp\all_212.102.63.147_misc.txt2⤵
- Enumerates connected drives
- Drops file in Windows directory
- Event Triggered Execution: Netsh Helper DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b.exe"C:\Users\Admin\AppData\Local\Temp\c44dc08a38e574bfba2e8ff7e0c95d6f4d26d0b041ad60df24cbf95d1be4e85b.exe" -group=system -outputfile=C:\Windows\Temp\all_212.102.63.147_system.txt2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD511f432954ed735a68f4d26ff1cc02102
SHA1805982fe48937a6aa68aad81c9fa1da90f350436
SHA256b4cfe048093e04457f562d4d9e2e734ed00c18e1a8504d1385b1561dffdf9c88
SHA5126ffe19da226696500d09d1ab48683080b4222e2e0a3af2dd9b729af443e383545b6d696873e070e5ff4335a11273efe593941ea7982d87a2d1d9df2bf743524b
-
Filesize
47KB
MD5422650b6a714aae5b593fc3274bd2e9b
SHA1c73a2e3dcb1dc701b9985190d7818e15bde13d04
SHA25698b5ece5d11b003b830d61444e6963b55be3107767e5ca85049ede8aeac71cea
SHA512c9ce5d271c17e7389d433794671bca77b0952681f7551a50e0dee20a702bc195e7c46d87afd6ee27018cde743ceba2db5a63ccac05c62321ad41d9388f46570e
-
Filesize
16KB
MD5cd18c2aab7960c14a2a478ffd1b3ef57
SHA1f7fa882d6fa588ad7df8484aa1009a7a88735eb5
SHA256920af0ef933f2325a83676c22d7dfcadae80b52904d78f99a90f0a5c95a8a0db
SHA512a2f796e9cb0e04a8c8ff74c33345861807bc644d33b572702c06997594d5b3959c1d30016bed1866918a0939a83dfc6c46f58f55888e8074d94fa5ff78df38a0
-
Filesize
5.9MB
-
Filesize
148KB
-
Filesize
5.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
584KB
-
Filesize
584KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
640KB
-
Filesize
9.9MB