bcd1cb815a9960f88dd5571fdf28126f05bef4c5a8dc26ddac4a2f39556968e7

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cstealer.pyc
Size

39KB
MD5

bbb61d55d0cbadd6b90e90b8660c7ba5
SHA1

9ad527366f65f5764b3e730ecaebebbf787d0716
SHA256

edd29cdb80faedc9f730c70d4c3380a21fa5492281734405db7cb8c140044956
SHA512

9e558b29aa850b560c5713fb3dfe32657f3dab11544013f8f38701c5e5525dcd3ae589a99c71446dd54bd8767d9d6c266dcf14c679c435ecb221dd94b8f6290b
SSDEEP

768:fuFYat61k17WnMAF+5JsylM3jp7UBHcxoZUM4PqVfqrY9Wygqxie1HrKl4HYi7ey:epQkW+JsyC3FpOUM6qVirY9WygWiCu1S

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2984 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2984 AcroRd32.exe
2984 AcroRd32.exe

pid	process
2984	AcroRd32.exe

pid	process
2984	AcroRd32.exe
2984	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2240 wrote to memory of 2616	2240	cmd.exe	rundll32.exe
PID 2240 wrote to memory of 2616	2240	cmd.exe	rundll32.exe
PID 2240 wrote to memory of 2616	2240	cmd.exe	rundll32.exe
PID 2616 wrote to memory of 2984	2616	rundll32.exe	AcroRd32.exe
PID 2616 wrote to memory of 2984	2616	rundll32.exe	AcroRd32.exe
PID 2616 wrote to memory of 2984	2616	rundll32.exe	AcroRd32.exe
PID 2616 wrote to memory of 2984	2616	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cstealer.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cstealer.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2616

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cstealer.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2984

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
67bcdf44d3850e3f694315eca2e79654

SHA1
40e2076aa934452181d4df17323c39cb0d2b3287

SHA256
3c3dde4e978ce974a8454749f211cb803a0bb7c0405922897aff0105b138a479

SHA512
4bea9744c453fc7af68c1642cbbdc6c7d7051ed427810bfe8e79a0f62b5c28935c1d701db8353a2c4a3d5e7ff0e4bdb7bdf7ab8f93dcd18b2f837fc32de30a42

Download Submit