9d8b9ba55cd5dfa3b2b678539d3e25926d415cd96a7ef8169525baaa06838ff9

Analysis

max time kernel
45s
max time network
16s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cstealer.pyc
Size

67KB
MD5

f0b888fbf9b2c319ba828cb623992abf
SHA1

a8bc0389d054fc398b4fc40b2b6ee02fe65b240f
SHA256

e3606d7dfe5666db81b9ae1e8d48a5303719f950c7505cb7d3f1e849e2391471
SHA512

6a2decec3631e277518807d484d58816b6619d44b1dc7404b01788188dec41039a87d4020fcb1b58310d5b487107a7cf315e5f4691330bf9c4e72fbe4c8d13e6
SSDEEP

1536:l0xqOgoxpqBJlMstbo88jLQQFX3qS0Vr+LRheG:lqv/+bo88PDXh0r+LRP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2720 AcroRd32.exe
2720 AcroRd32.exe

pid	process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1752 wrote to memory of 2540	1752	cmd.exe	rundll32.exe
PID 1752 wrote to memory of 2540	1752	cmd.exe	rundll32.exe
PID 1752 wrote to memory of 2540	1752	cmd.exe	rundll32.exe
PID 2540 wrote to memory of 2720	2540	rundll32.exe	AcroRd32.exe
PID 2540 wrote to memory of 2720	2540	rundll32.exe	AcroRd32.exe
PID 2540 wrote to memory of 2720	2540	rundll32.exe	AcroRd32.exe
PID 2540 wrote to memory of 2720	2540	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cstealer.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cstealer.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2540

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cstealer.pyc"
3⤵
- Suspicious use of SetWindowsHookEx
PID:2720

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
9280c6c3d04512f3321bd04d610e35ac

SHA1
ddd9135bee502b53322026e81037de0c9c14ba9c

SHA256
e03ba6833eae2c89e2c5f2f97135d1b493174e692b36857fd24657ed2fe520c1

SHA512
24303088345788ec27972ec487b3d5b78b29231a7556196982a865771871eaed6986645e5e415ec8f0e373aa62ab15cd7de143907d2d4478be7a6510192447a7

Download Submit