Analysis
- max time kernel
149s - max time network
137s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
01/12/2025, 00:17
General
- Target g.exe
- Size 544KB
- Sample251201-ak94natjcl
- SHA256 aa3e361da204814ad64fc500de97574ea79686683707ef8233497b6567375de0
Malware Config
Signatures
- DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
- Deerstealer family
- Detects DeerStealer 3 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\g.exe"C:\Users\Admin\AppData\Local\Temp\g.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3nvanjpfp5se.exeC:\Users\Admin\AppData\Local\Temp\3nvanjpfp5se.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\xxbivhbl679l.exeC:\Users\Admin\AppData\Local\Temp\xxbivhbl679l.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\x2xayzyx5dwb.exeC:\Users\Admin\AppData\Local\Temp\x2xayzyx5dwb.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\ujs1ym2zr84o.exeC:\Users\Admin\AppData\Local\Temp\ujs1ym2zr84o.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdateHelper\update_helper.exeC:\Users\Admin\AppData\Roaming\WindowsUpdateHelper\update_helper.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3nvanjpfp5se.exe
xxbivhbl679l.exe
memory/2124-2092-0x00007FF73F7A0000-0x00007FF73FA93000-memory.dmp
memory/2124-2089-0x00007FF73F7A0000-0x00007FF73FA93000-memory.dmp
memory/2956-2633-0x00007FF7B8D70000-0x00007FF7B9063000-memory.dmp
memory/2956-2624-0x00007FF7B8D70000-0x00007FF7B9063000-memory.dmp
memory/2956-518-0x00007FF7B8D70000-0x00007FF7B9063000-memory.dmp
memory/4628-526-0x000001C98E5A0000-0x000001C98E5D5000-memory.dmp
memory/4628-1046-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1032-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1049-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1048-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1041-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1028-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1026-0x000001C997A70000-0x000001C997AA5000-memory.dmp
memory/4628-1047-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1033-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1045-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1044-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1043-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1042-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1040-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1039-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1035-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/4628-1034-0x000001C997BC0000-0x000001C997C11000-memory.dmp
memory/5712-2070-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2080-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2093-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2090-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2074-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2075-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2076-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2077-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2078-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2079-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2086-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2085-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2084-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2083-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2082-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5712-2081-0x000001F563630000-0x000001F563681000-memory.dmp
memory/5848-1961-0x000001F2EBCE0000-0x000001F2EBD03000-memory.dmp
memory/5848-500-0x000001F2E77D0000-0x000001F2E77E7000-memory.dmp
memory/5848-0-0x000001F2E1F90000-0x000001F2E1FA7000-memory.dmp
memory/5848-1962-0x000001F2EBCE0000-0x000001F2EBD03000-memory.dmp
memory/5848-1954-0x000001F2EBCE0000-0x000001F2EBD03000-memory.dmp
memory/5848-1251-0x000001F2E7910000-0x000001F2E7933000-memory.dmp
memory/5848-508-0x000001F2E7910000-0x000001F2E7933000-memory.dmp
memory/5848-501-0x000001F2E7800000-0x000001F2E7804000-memory.dmp
memory/5848-1960-0x000001F2EBCE0000-0x000001F2EBD03000-memory.dmp
memory/5848-1959-0x000001F2EBCE0000-0x000001F2EBD03000-memory.dmp
memory/5848-1958-0x000001F2EBCE0000-0x000001F2EBD03000-memory.dmp
memory/5848-510-0x000001F2E7910000-0x000001F2E7933000-memory.dmp
memory/5848-507-0x000001F2E7910000-0x000001F2E7933000-memory.dmp
memory/5848-506-0x000001F2E7910000-0x000001F2E7933000-memory.dmp
memory/5848-502-0x000001F2E7910000-0x000001F2E7933000-memory.dmp
memory/5848-509-0x000001F2E7910000-0x000001F2E7933000-memory.dmp
memory/6060-2609-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2618-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2617-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2616-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2615-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2614-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2613-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2612-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2611-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2610-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2607-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2606-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2608-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp
memory/6060-2602-0x0000024ECE660000-0x0000024ECE6B1000-memory.dmp