bcd1cb815a9960f88dd5571fdf28126f05bef4c5a8dc26ddac4a2f39556968e7

Analysis

max time kernel
365s
max time network
378s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cstealer.pyc
Size

39KB
MD5

bbb61d55d0cbadd6b90e90b8660c7ba5
SHA1

9ad527366f65f5764b3e730ecaebebbf787d0716
SHA256

edd29cdb80faedc9f730c70d4c3380a21fa5492281734405db7cb8c140044956
SHA512

9e558b29aa850b560c5713fb3dfe32657f3dab11544013f8f38701c5e5525dcd3ae589a99c71446dd54bd8767d9d6c266dcf14c679c435ecb221dd94b8f6290b
SSDEEP

768:fuFYat61k17WnMAF+5JsylM3jp7UBHcxoZUM4PqVfqrY9Wygqxie1HrKl4HYi7ey:epQkW+JsyC3FpOUM6qVirY9WygWiCu1S

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1568 OpenWith.exe

pid	process
1568	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cstealer.pyc
1⤵
- Modifies registry class
PID:1532

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads