Resubmissions
14/04/2025, 07:51
250414-jp1kfssjz9 1014/04/2025, 07:46
250414-jl9nyssjt9 1008/04/2025, 15:58
250408-tevasswl18 1008/04/2025, 14:19
250408-rm2nqsvqw2 10Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
-
submitted
14/04/2025, 07:51
General
-
Target
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe
-
Size
3.3MB
-
MD5
54681d828ea105cc3603c08eb985dd5b
-
SHA1
6958c3b1c8ab17e3e574f2ed899d02e0e97ae32d
-
SHA256
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8
-
SHA512
e8f62f02e5b81f4d6384b5289ff9e358297559b92f7519a991ad14de14907adb390a014434210f759d0ee8a6290dee8c5bb9a10ec3addcf614b02f7caddd6e25
-
SSDEEP
98304:RRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/0:Rkj8NBFwxpNOuk2H
Malware Config
Signatures
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe"C:\Users\Admin\AppData\Local\Temp\f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2gbPE68h8BV127K.exe"C:\Users\Admin\AppData\Local\Temp\2gbPE68h8BV127K.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGY5OTBkODUwZTExMWJmMzYxMTI0YTVhMjdjMjliNTYzNDUwM2YyYzhmMmM3MTBiYmYwNjkzYmQ0ZjU1N2Y1ZjguZXhl2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop "SysMain"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config "SysMain" start=disabled4⤵
- Launches sc.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD51a570c9da650f924f381486f53a84a8a
SHA182aa43b54301cfa23615aebb287b530d35b619ec
SHA256954cdd1eaff1b333a0c69b46c639a3b8af7000e29f4104b4a6cb169f4b662f67
SHA512b3964977c0f816815c3ca1a622d5d5d555b0bcfc8c41a106d4ddcea7a969050c492154ef774ca87f24b3965173775ca1efef678c5c0e4bb666cf99a01dc7f942
-
Filesize
200KB
-
Filesize
24KB
-
Filesize
192KB
-
Filesize
10.8MB
-
Filesize
4.2MB
-
Filesize
16KB
-
Filesize
8KB
-
Filesize
624KB
-
Filesize
24KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
744KB
-
Filesize
10.8MB
-
Filesize
3.1MB
-
Filesize
16KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
456KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
10.8MB
-
Filesize
10.8MB