Resubmissions
14/04/2025, 07:51
250414-jp1kfssjz9 1014/04/2025, 07:46
250414-jl9nyssjt9 1008/04/2025, 15:58
250408-tevasswl18 1008/04/2025, 14:19
250408-rm2nqsvqw2 10Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
08/04/2025, 14:19
General
-
Target
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe
-
Size
3.3MB
-
MD5
54681d828ea105cc3603c08eb985dd5b
-
SHA1
6958c3b1c8ab17e3e574f2ed899d02e0e97ae32d
-
SHA256
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8
-
SHA512
e8f62f02e5b81f4d6384b5289ff9e358297559b92f7519a991ad14de14907adb390a014434210f759d0ee8a6290dee8c5bb9a10ec3addcf614b02f7caddd6e25
-
SSDEEP
98304:RRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/0:Rkj8NBFwxpNOuk2H
Malware Config
Signatures
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe"C:\Users\Admin\AppData\Local\Temp\f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4hNK8J5c68qsm4.exe"C:\Users\Admin\AppData\Local\Temp\4hNK8J5c68qsm4.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGY5OTBkODUwZTExMWJmMzYxMTI0YTVhMjdjMjliNTYzNDUwM2YyYzhmMmM3MTBiYmYwNjkzYmQ0ZjU1N2Y1ZjguZXhl2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop "SysMain"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config "SysMain" start=disabled4⤵
- Launches sc.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD5da666a48751d7f896c13024a6cba4e1f
SHA139bd60aef0c23d2ca11d082f9115118c0f9a1d73
SHA25665ae6382087fda06f3a6f39724073f0a02f35715f11cfd5394e35e3348bbc540
SHA51226fc07a73a70909f32c4708605f7251a2fb7db4949e4e91d5b2932ff1a270bdf73e56386aff9474b7bffcd9dba154fa6e5446b9327d641e9833c6d73142d26d7
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
456KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
3.1MB
-
Filesize
16KB
-
Filesize
10.8MB
-
Filesize
200KB
-
Filesize
16KB
-
Filesize
32KB
-
Filesize
24KB
-
Filesize
624KB
-
Filesize
744KB
-
Filesize
24KB
-
Filesize
8KB
-
Filesize
4.2MB
-
Filesize
10.8MB
-
Filesize
192KB
-
Filesize
2.9MB
-
Filesize
3.1MB