Overview
overview
10Static
static
3Engine.js
windows7-x64
3Engine.js
windows10-2004-x64
3Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10bin/UbuilderB.exe
windows7-x64
1bin/UbuilderB.exe
windows10-2004-x64
7bin/scv.jar
windows7-x64
1bin/scv.jar
windows10-2004-x64
1cutline.ppt
windows7-x64
1cutline.ppt
windows10-2004-x64
1d3dx9_43.dll
windows7-x64
1d3dx9_43.dll
windows10-2004-x64
1packages/D...1].exe
windows7-x64
1packages/D...1].exe
windows10-2004-x64
1xNet.dll
windows7-x64
1xNet.dll
windows10-2004-x64
1Analysis
-
max time kernel
37s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 01:01
Static task
static1
Behavioral task
behavioral1
Sample
Engine.js
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Engine.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
bin/UbuilderB.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
bin/UbuilderB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
bin/scv.jar
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
bin/scv.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
cutline.ppt
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
cutline.ppt
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
d3dx9_43.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
d3dx9_43.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
packages/DirectoryMonitor_[1MB]_[1].exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
packages/DirectoryMonitor_[1MB]_[1].exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
xNet.dll
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
xNet.dll
Resource
win10v2004-20240508-en
General
-
Target
Setup.exe
-
Size
2.7MB
-
MD5
870feaab725b148208dd12ffabe33f9d
-
SHA1
9f3651ad5725848c880c24f8e749205a7e1e78c1
-
SHA256
bbf7154f14d736f0c8491fb9fb44d2f179cdb02d34ab54c04466fa0702ea7d55
-
SHA512
5bea301f85e6a55fd5730793b960442bc4dab92d0bf47e4e55c5490448a4a22ed6d0feb1dbe9d56d6b6ff8d06f163381807f83f467621f527bc6521857fc8e1a
-
SSDEEP
49152:C11fbWXfBeBqTww8Gkfoa0yeL8zj9JLF+lP/MatsfHVnZbhG3EVsMI62Pseaj/1n:QbWkuwwjkULhlPUatsfBxhsE
Malware Config
Extracted
stealc
ANNA2
https://safefiledownloadsoft.com
-
url_path
/725c63b56c99aa26.php
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
TraceFmt.exepid process 4692 TraceFmt.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 3520 set thread context of 2668 3520 Setup.exe netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4480 4692 WerFault.exe TraceFmt.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exenetsh.exepid process 3520 Setup.exe 3520 Setup.exe 2668 netsh.exe 2668 netsh.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exenetsh.exepid process 3520 Setup.exe 2668 netsh.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Setup.exenetsh.exedescription pid process target process PID 3520 wrote to memory of 2668 3520 Setup.exe netsh.exe PID 3520 wrote to memory of 2668 3520 Setup.exe netsh.exe PID 3520 wrote to memory of 2668 3520 Setup.exe netsh.exe PID 3520 wrote to memory of 2668 3520 Setup.exe netsh.exe PID 2668 wrote to memory of 4692 2668 netsh.exe TraceFmt.exe PID 2668 wrote to memory of 4692 2668 netsh.exe TraceFmt.exe PID 2668 wrote to memory of 4692 2668 netsh.exe TraceFmt.exe PID 2668 wrote to memory of 4692 2668 netsh.exe TraceFmt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TraceFmt.exeC:\Users\Admin\AppData\Local\Temp\TraceFmt.exe3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 25004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4692 -ip 46921⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\Local\Temp\TraceFmt.exeFilesize
433KB
MD5fea067901f48a5f1faf7ca3b373f1a8f
SHA1e8abe0deb87de9fe3bb3a611234584e9a9b17cce
SHA256bf24b2f3e3a3c60ed116791b99e5421a4de34ac9c6e2201d34ab487e448ce152
SHA51207c83a2d3d5dd475bc8aa48eba9b03e8fb742dbbd7bd623ed05dc1086efed7dfd1c1b8f037ee2e81efba1de58ea3243d7c84ac8b484e808cd28765f9c7517023
-
C:\Users\Admin\AppData\Local\Temp\a1f40a73Filesize
1.3MB
MD5ee42b4e474deb2fad749a48b64e41f3f
SHA10d33f458d58d97f09a134e8da63823fbaa54e206
SHA2560bd162d3cdc68c9bfa482a437807f410243410d7877110d70266cb102050c2aa
SHA512bb135d599d4e04a7cd3bb9b7c26cd7bfb2ab3b1934d1c401f11723ecd5ba50efe128f63a3bd795b479514564538c7c94387a91dffbb09d16358aaf081d0b8c08
-
memory/2668-16-0x0000000074541000-0x000000007454F000-memory.dmpFilesize
56KB
-
memory/2668-11-0x00007FFFBC790000-0x00007FFFBC985000-memory.dmpFilesize
2.0MB
-
memory/2668-14-0x0000000074541000-0x000000007454F000-memory.dmpFilesize
56KB
-
memory/2668-13-0x000000007454E000-0x0000000074550000-memory.dmpFilesize
8KB
-
memory/2668-104-0x000000007454E000-0x0000000074550000-memory.dmpFilesize
8KB
-
memory/2668-9-0x0000000074541000-0x000000007454F000-memory.dmpFilesize
56KB
-
memory/3520-6-0x0000000074540000-0x00000000746BB000-memory.dmpFilesize
1.5MB
-
memory/3520-7-0x0000000074540000-0x00000000746BB000-memory.dmpFilesize
1.5MB
-
memory/3520-0-0x0000000074540000-0x00000000746BB000-memory.dmpFilesize
1.5MB
-
memory/3520-5-0x0000000074552000-0x0000000074554000-memory.dmpFilesize
8KB
-
memory/3520-1-0x00007FFFBC790000-0x00007FFFBC985000-memory.dmpFilesize
2.0MB
-
memory/4692-20-0x00007FFFBC790000-0x00007FFFBC985000-memory.dmpFilesize
2.0MB
-
memory/4692-23-0x0000000000095000-0x000000000009D000-memory.dmpFilesize
32KB
-
memory/4692-31-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/4692-24-0x0000000000050000-0x000000000010A000-memory.dmpFilesize
744KB
-
memory/4692-21-0x0000000000480000-0x00000000006BE000-memory.dmpFilesize
2.2MB
-
memory/4692-103-0x0000000000480000-0x00000000006BE000-memory.dmpFilesize
2.2MB
-
memory/4692-17-0x0000000000480000-0x00000000006BE000-memory.dmpFilesize
2.2MB