8b0f9d248e67199bb7f1a778a03e4caee7d267e61d8a7d70fa1c1f6d7944e96a

Submit
Reports

Overview

overview

Static

static

30bc4934d7...f0.exe

windows7-x64

30bc4934d7...f0.exe

windows10-2004-x64

338fdf3626...13.exe

windows7-x64

338fdf3626...13.exe

windows10-2004-x64

342933cb4c...20.exe

windows7-x64

342933cb4c...20.exe

windows10-2004-x64

343ace5874...03.exe

windows7-x64

343ace5874...03.exe

windows10-2004-x64

34818CE171...49.dll

windows7-x64

34818CE171...49.dll

windows10-2004-x64

360390_crypt.exe

windows7-x64

360390_crypt.exe

windows10-2004-x64

360390_tree.cmd

windows7-x64

360390_tree.cmd

windows10-2004-x64

3896f8a370...e_.exe

windows7-x64

3896f8a370...e_.exe

windows10-2004-x64

3a061ee07d...8c.dll

windows7-x64

3a061ee07d...8c.dll

windows10-2004-x64

3af4fa2bff...d1.dll

windows7-x64

3af4fa2bff...d1.dll

windows10-2004-x64

3bb691982d...21.exe

windows7-x64

3bb691982d...21.exe

windows10-2004-x64

3e3f980ab6...95.exe

windows7-x64

3e3f980ab6...95.exe

windows10-2004-x64

3e3f980ab6...26.exe

windows7-x64

3e3f980ab6...26.exe

windows10-2004-x64

3e75e8238a..._2.exe

windows7-x64

3e75e8238a..._2.exe

windows10-2004-x64

400cad56ff...9a.exe

windows7-x64

400cad56ff...9a.exe

windows10-2004-x64

40b3cb2a21...0c.exe

windows7-x64

40b3cb2a21...0c.exe

windows10-2004-x64

Resubmissions

28/03/2025, 16:52

250328-vdc6kazry9 9

24/03/2025, 22:22

250324-2aphra1jx7 10

Analysis

max time kernel
42s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 16:52

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx macro

5 signatures

Behavioral task

behavioral1

Sample

30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe

Resource

win7-20240729-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe

Resource

win7-20241010-en

discovery

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral6

Sample

342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe

Resource

win10v2004-20250314-en

discovery persistence ransomware spyware stealer

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral7

Sample

343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe

Resource

win7-20240903-en

discovery

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe

Resource

win10v2004-20250314-en

defense_evasion discovery persistence

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral9

Sample

34818CE171EA150B91429AC1DD6FBE49.dll

Resource

win7-20240903-en

defense_evasion discovery

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral10

Sample

34818CE171EA150B91429AC1DD6FBE49.dll

Resource

win10v2004-20250314-en

defense_evasion discovery

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral11

Sample

360390_crypt.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

360390_crypt.exe

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral13

Sample

360390_tree.cmd

Resource

win7-20241010-en

spyware stealer

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

360390_tree.cmd

Resource

win10v2004-20250314-en

spyware stealer

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe

Resource

win7-20240903-en

bootkit discovery persistence

windows7-x64

23 signatures

150 seconds

Behavioral task

behavioral16

Sample

3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe

Resource

win10v2004-20250313-en

bootkit discovery persistence

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral17

Sample

3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll

Resource

win7-20241010-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll

Resource

win7-20240729-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe

Resource

win7-20250207-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe

Resource

win10v2004-20250313-en

credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral23

Sample

3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral25

Sample

3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe

Resource

win7-20241010-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral27

Sample

3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral28

Sample

3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe

Resource

win10v2004-20250313-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral29

Sample

400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe

Resource

win7-20240729-en

defense_evasion discovery persistence upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral30

Sample

400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe

Resource

win10v2004-20250314-en

defense_evasion discovery persistence upx

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral31

Sample

40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe

Resource

win7-20241010-en

defense_evasion discovery trojan

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral32

Sample

40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe

Resource

win10v2004-20250314-en

defense_evasion discovery execution impact persistence ransomware trojan

windows10-2004-x64

11 signatures

150 seconds

Report Analysis Logs

General

Target

360390_tree.cmd
Size

15KB
MD5

49163792f3b8c4f62018670033e9fc82
SHA1

f2d8da51a9371cebc0fd41cb3d86f3768e791fae
SHA256

4637c6b332d640450e7cb3ae6a6b0d7d4451454770699acf364d855e28805267
SHA512

2fd7a02da20ca41c27b30f272bbf3bb186187492fc927a9dc8c7ea36b22c9e8ac6906428cab27eb7f907a21f352a2c7ed6ce60e48e0d9c35238a71ee8be6efad
SSDEEP

192:iJCJ+JGJ6JaJeJWJSJSJeJ2J2bJ6JeJGJiJiJ+JmJ6JaJeJWJSJSJ05:iIU8Ao8Ug4UMcbYM0goUcAIcUg4C5

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Processes

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\360390_tree.cmd"
1⤵
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads