Resubmissions
14/04/2025, 07:51
250414-jp1kfssjz9 1014/04/2025, 07:46
250414-jl9nyssjt9 1008/04/2025, 15:58
250408-tevasswl18 1008/04/2025, 14:19
250408-rm2nqsvqw2 10Analysis
-
max time kernel
149s -
max time network
105s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
-
submitted
14/04/2025, 07:46
General
-
Target
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe
-
Size
3.3MB
-
MD5
54681d828ea105cc3603c08eb985dd5b
-
SHA1
6958c3b1c8ab17e3e574f2ed899d02e0e97ae32d
-
SHA256
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8
-
SHA512
e8f62f02e5b81f4d6384b5289ff9e358297559b92f7519a991ad14de14907adb390a014434210f759d0ee8a6290dee8c5bb9a10ec3addcf614b02f7caddd6e25
-
SSDEEP
98304:RRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/0:Rkj8NBFwxpNOuk2H
Malware Config
Signatures
-
Stops running service(s) 4 TTPs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe"C:\Users\Admin\AppData\Local\Temp\f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zjsb2CVRefD1K2.exe"C:\Users\Admin\AppData\Local\Temp\zjsb2CVRefD1K2.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGY5OTBkODUwZTExMWJmMzYxMTI0YTVhMjdjMjliNTYzNDUwM2YyYzhmMmM3MTBiYmYwNjkzYmQ0ZjU1N2Y1ZjguZXhl2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop "SysMain"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config "SysMain" start=disabled4⤵
- Launches sc.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD52de1f2b469f1d589e0eb4328e09ce987
SHA152e9a30710218531dafda86e42bad890c122906a
SHA25609a91809298740c9a15dcc2bdabeae3fa2e752f0ea93df018fd0741139dffff1
SHA51265806b7c1df8ebd8c7dddfb031a529ee141020412f0cc35fcb424883a9c1fcb7aeeddb5db51ffb17828d3ee1259ca5715967a628779086831193daa039387a94
-
Filesize
200KB
-
Filesize
24KB
-
Filesize
192KB
-
Filesize
10.8MB
-
Filesize
4.2MB
-
Filesize
16KB
-
Filesize
8KB
-
Filesize
624KB
-
Filesize
24KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
744KB
-
Filesize
10.8MB
-
Filesize
3.1MB
-
Filesize
16KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
456KB
-
Filesize
24KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB