Overview

overview

10

Static

static

10

9ccfdd44ee...54.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    127s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2025, 07:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9ccfdd44ee5fede8d813441081c37054.exe

  • Size

    1.2MB

  • MD5

    9ccfdd44ee5fede8d813441081c37054

  • SHA1

    645baedccb045294e5e00e8632316c8d0e349bdc

  • SHA256

    da4d4bdb72382261383f2b08e86cb670a2ca99acef22c5866187371ec537ba91

  • SHA512

    79f68ee36c42d4d68af62e42cf5c9b7d420c18d7bdca09fb7d40784cf3b95caed41798b47b04e783fdbdff169046ea1bca329ca876a97a663116f385b0271344

  • SSDEEP

    24576:tHjTwpzGkqDZBI6JNwsqG5nDCsGf5Qa9u+aasbWgxU:RjTwpzGLq6JPDCsGh2r

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ccfdd44ee5fede8d813441081c37054.exe
    "C:\Users\Admin\AppData\Local\Temp\9ccfdd44ee5fede8d813441081c37054.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Users\Admin\AppData\Local\Temp\temp_23646.exe
      "C:\Users\Admin\AppData\Local\Temp\temp_23646.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:3172
    • C:\Users\Admin\AppData\Local\Temp\temp_23650.exe
      "C:\Users\Admin\AppData\Local\Temp\temp_23650.exe"
      2⤵
      • Executes dropped EXE
      PID:4280
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_23646.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3612
    • C:\Users\Admin\AppData\Local\Temp\temp_23646.exe
      C:\Users\Admin\AppData\Local\Temp\temp_23646.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5752
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Winserv\winserv.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5312
    • C:\Users\Admin\AppData\Roaming\Winserv\winserv.exe
      C:\Users\Admin\AppData\Roaming\Winserv\winserv.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\History
    Filesize

    192KB

    MD5

    83c468b78a1714944e5becf35401229b

    SHA1

    5bb1aaf85b2b973e4ba33fa8457aaf71e4987b34

    SHA256

    da5fdb5a9d869b349244f1ab62d95b0dbd05ac12ff45a6db157da829566a6690

    SHA512

    795aa24a35781ea1e91cdb1760aef90948a61c0f96f94f20585662bdce627443a702f7b2637472cb595e027b1989cec822959dcad4b121928dbb2f250b2df599

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\temp_23646.exe
    Filesize

    177KB

    MD5

    a84b1c3b52cca1e711f6ab96b6cab2b2

    SHA1

    952516e5427aed05cd12c3007d45cdc46e2e1c64

    SHA256

    e77bd161308fe005519f0ac053698ca7e05a76a0fc1e6e2b9f569a1a2c080488

    SHA512

    fbca24489be96883f45929d815c72944b9983f7c6a6cf50c894c3d30428d98c0307f182648508d76cd036a6fc1b8780b1a3d3927e95a627d0772365ad553b55c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\temp_23650.exe
    Filesize

    253KB

    MD5

    a6799120a6cd0a439e69cef0b39766f1

    SHA1

    370711ba4a565d3b2bfa70d593e3ae2abfdeed9f

    SHA256

    e2f2eadd2865cc21f36f641be666beaab4e97ccd2c56ba522846d1dd89f3a484

    SHA512

    bb4e2ce1efffcc0ab3d11316f6bbb936a81c6093541a0395f995451b300a8a531bec35f56d53ff110fac6c2d9d4d515388dc1b8a42c45d1108ad179e27ca186c

    Download Submit