Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
08/04/2025, 14:11
General
-
Target
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe
-
Size
3.3MB
-
MD5
54681d828ea105cc3603c08eb985dd5b
-
SHA1
6958c3b1c8ab17e3e574f2ed899d02e0e97ae32d
-
SHA256
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8
-
SHA512
e8f62f02e5b81f4d6384b5289ff9e358297559b92f7519a991ad14de14907adb390a014434210f759d0ee8a6290dee8c5bb9a10ec3addcf614b02f7caddd6e25
-
SSDEEP
98304:RRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/0:Rkj8NBFwxpNOuk2H
Malware Config
Signatures
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe"C:\Users\Admin\AppData\Local\Temp\f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\o4UuCH7nfrIhT2U.exe"C:\Users\Admin\AppData\Local\Temp\o4UuCH7nfrIhT2U.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGY5OTBkODUwZTExMWJmMzYxMTI0YTVhMjdjMjliNTYzNDUwM2YyYzhmMmM3MTBiYmYwNjkzYmQ0ZjU1N2Y1ZjguZXhl2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop "SysMain"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config "SysMain" start=disabled4⤵
- Launches sc.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5fb044749e6520233fcf5b9f57ef753a2
SHA19c0c561d8d696f299c53a7b527f8eab1fe284f03
SHA256373303fca1ceb8aa64c47e8618ef7b8c52e4f6c4891b58607be5e5fecfa50e0e
SHA5120d9add6532c6ffb084016f34d6f3577bf003f9f2f2820356b5520ebc4670fba7db4d0c52f6005448fedcff815b5effdf66187c4d7a260ebb3c4e4be5cb983f8d
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
24KB
-
Filesize
456KB
-
Filesize
200KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
3.1MB
-
Filesize
16KB
-
Filesize
624KB
-
Filesize
16KB
-
Filesize
744KB
-
Filesize
32KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
200KB
-
Filesize
24KB
-
Filesize
8KB
-
Filesize
4.2MB
-
Filesize
10.8MB
-
Filesize
192KB
-
Filesize
2.9MB
-
Filesize
3.1MB