Analysis
-
max time kernel
41s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2024 04:27
Behavioral task
behavioral1
Sample
fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe
Resource
win7-20240221-en
General
-
Target
fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe
-
Size
149KB
-
MD5
eda1749ecd5d30aebc623e3ed3679e33
-
SHA1
36bac5bad466a15b4385bf1bc07e681682c277cd
-
SHA256
fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134
-
SHA512
d08fae35eb98f3d7c6a1dbff195510502d3c382cb2b59d8d1b46c44a5369924ac54bd1160808a28518bf121070b03c98471881f560e69f26df90be6b9b7320db
-
SSDEEP
3072:mF1w5ZnALHQ1h18DI1+u5hIBzl+J3fu3/Xd35qVpUnTiuPA9QPOFqGxB1/D:UqjnALHQ1h18DI1++kObVpUnTiuPA9Qm
Malware Config
Signatures
-
Detect Xehook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3148-1-0x0000000000820000-0x000000000084C000-memory.dmp family_xehook -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exepowershell.exepid process 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe 4728 powershell.exe 4728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exepowershell.exedescription pid process Token: SeDebugPrivilege 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe Token: SeDebugPrivilege 4728 powershell.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exedescription pid process target process PID 3148 wrote to memory of 4728 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe powershell.exe PID 3148 wrote to memory of 4728 3148 fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe"C:\Users\Admin\AppData\Local\Temp\fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Start-Process 'C:\Users\Admin\AppData\Roaming\3NW7S19GWX.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\3NW7S19GWX.exe"C:\Users\Admin\AppData\Roaming\3NW7S19GWX.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_00uh22ex.dii.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\3NW7S19GWX.exeFilesize
435KB
MD5e59050788e19323cd4bdd344ed4e185e
SHA19e37f9e4345023c9c1fee70b6539779d78bbd288
SHA256681bb393173d7621fc8432c24a06c716dc19678aa7a64dbe873f914595884997
SHA5123d7061659aff4f6f9eb709f9929a51ffec682c4c1c8489d04b72739e15854c6676b7057e6f46c6b4346cead008afb4e36441c1058cd1f2810135428c438d04a4
-
memory/3148-23-0x00007FFAE92C0000-0x00007FFAE9D81000-memory.dmpFilesize
10.8MB
-
memory/3148-1-0x0000000000820000-0x000000000084C000-memory.dmpFilesize
176KB
-
memory/3148-2-0x0000000001010000-0x000000000102A000-memory.dmpFilesize
104KB
-
memory/3148-3-0x00007FFAE92C0000-0x00007FFAE9D81000-memory.dmpFilesize
10.8MB
-
memory/3148-4-0x00007FFAE92C3000-0x00007FFAE92C5000-memory.dmpFilesize
8KB
-
memory/3148-0-0x00007FFAE92C3000-0x00007FFAE92C5000-memory.dmpFilesize
8KB
-
memory/4060-71-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-57-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-25-0x00000000056D0000-0x00000000057AC000-memory.dmpFilesize
880KB
-
memory/4060-41-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-59-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-73-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-79-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-89-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-88-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-85-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-83-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-81-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-77-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-75-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-6296-0x0000000005AD0000-0x0000000005B36000-memory.dmpFilesize
408KB
-
memory/4060-69-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-67-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-65-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-64-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-24-0x0000000000D50000-0x0000000000DC4000-memory.dmpFilesize
464KB
-
memory/4060-55-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-53-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-52-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-47-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-45-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-43-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-37-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-35-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-33-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-61-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-49-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-39-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-31-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-29-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-27-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4060-26-0x00000000056D0000-0x00000000057A7000-memory.dmpFilesize
860KB
-
memory/4728-17-0x0000028F1E4D0000-0x0000028F1E4F2000-memory.dmpFilesize
136KB