c76d25be072f587dec61a182dbb0c485e1e8c66bccd1a613bb548c64172fa3cb

Analysis

max time kernel
150s
max time network
131s
platform
windows10_x64
resource
win10v20210410
submitted
18/04/2021, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
857ab1a996a1b759f32006815532433b.exe
Size 686KB
Sample210418-d5ev42s8c6
SHA256 c76d25be072f587dec61a182dbb0c485e1e8c66bccd1a613bb548c64172fa3cb
MD5 857ab1a996a1b759f32006815532433b
SHA1 422fb1f66c3c36f13005cccfd7337d97e31d6a73
SHA512 03698cf8a6cb7c5725288e60c855dd85f9826ca8499b14e8ad3e4f5e93e2214e32f491112f628b407164a5294488fa1f37652e0205f4b8d99f20b701dce2331b
MD5 SHA1 SHA512

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
8	Largus.exe
3748	4.exe
2100	vpn.exe
2812	SmartClock.exe
2344	Capace.exe.com
692	Capace.exe.com

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe

Loads dropped DLL 1 IoCs

pid	Process
8	Largus.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	857ab1a996a1b759f32006815532433b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	857ab1a996a1b759f32006815532433b.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1728	timeout.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2268	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2812	SmartClock.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3904	857ab1a996a1b759f32006815532433b.exe
3904	857ab1a996a1b759f32006815532433b.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 8	3904	857ab1a996a1b759f32006815532433b.exe	79
PID 3904 wrote to memory of 8	3904	857ab1a996a1b759f32006815532433b.exe	79
PID 3904 wrote to memory of 8	3904	857ab1a996a1b759f32006815532433b.exe	79
PID 3904 wrote to memory of 3856	3904	857ab1a996a1b759f32006815532433b.exe	80
PID 3904 wrote to memory of 3856	3904	857ab1a996a1b759f32006815532433b.exe	80
PID 3904 wrote to memory of 3856	3904	857ab1a996a1b759f32006815532433b.exe	80
PID 8 wrote to memory of 3748	8	Largus.exe	82
PID 8 wrote to memory of 3748	8	Largus.exe	82
PID 8 wrote to memory of 3748	8	Largus.exe	82
PID 8 wrote to memory of 2100	8	Largus.exe	83
PID 8 wrote to memory of 2100	8	Largus.exe	83
PID 8 wrote to memory of 2100	8	Largus.exe	83
PID 3856 wrote to memory of 1728	3856	cmd.exe	84
PID 3856 wrote to memory of 1728	3856	cmd.exe	84
PID 3856 wrote to memory of 1728	3856	cmd.exe	84
PID 2100 wrote to memory of 2660	2100	vpn.exe	85
PID 2100 wrote to memory of 2660	2100	vpn.exe	85
PID 2100 wrote to memory of 2660	2100	vpn.exe	85
PID 2100 wrote to memory of 4088	2100	vpn.exe	87
PID 2100 wrote to memory of 4088	2100	vpn.exe	87
PID 2100 wrote to memory of 4088	2100	vpn.exe	87
PID 4088 wrote to memory of 212	4088	cmd.exe	89
PID 4088 wrote to memory of 212	4088	cmd.exe	89
PID 4088 wrote to memory of 212	4088	cmd.exe	89
PID 3748 wrote to memory of 2812	3748	4.exe	90
PID 3748 wrote to memory of 2812	3748	4.exe	90
PID 3748 wrote to memory of 2812	3748	4.exe	90
PID 212 wrote to memory of 644	212	cmd.exe	92
PID 212 wrote to memory of 644	212	cmd.exe	92
PID 212 wrote to memory of 644	212	cmd.exe	92
PID 212 wrote to memory of 2344	212	cmd.exe	93
PID 212 wrote to memory of 2344	212	cmd.exe	93
PID 212 wrote to memory of 2344	212	cmd.exe	93
PID 212 wrote to memory of 2268	212	cmd.exe	94
PID 212 wrote to memory of 2268	212	cmd.exe	94
PID 212 wrote to memory of 2268	212	cmd.exe	94
PID 2344 wrote to memory of 692	2344	Capace.exe.com	95
PID 2344 wrote to memory of 692	2344	Capace.exe.com	95
PID 2344 wrote to memory of 692	2344	Capace.exe.com	95

C:\Users\Admin\AppData\Local\Temp\857ab1a996a1b759f32006815532433b.exe
"C:\Users\Admin\AppData\Local\Temp\857ab1a996a1b759f32006815532433b.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\Largus.exe
  "C:\Users\Admin\AppData\Local\Temp\Largus.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
    "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
      "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      PID:2812
- - C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
    "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\SysWOW64\makecab.exe
      "C:\Windows\System32\makecab.exe"
      4⤵
      PID:2660
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ikrpMsnsAXjBMVSfAwoJjgmBzZZS & cmd < Rivederla.tmp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4088
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:212
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^owMiqiEnqvgCmOVeldcOJjVnWyTuLQhmYUgQOuIQvzJwEJGhKKSsWIZWygkVhnNpoPEEAtgtHEadCTThnGvwYVCfVaLAVNCXFASOtwNFvOJsdIzkxXvHeMlhhgJizNo$" Col.tmp
        6⤵
        
        PID:644
      - C:\Users\Admin\AppData\Roaming\HIgJUuYXnxawtktaHAZhVxcgGJSMBQMsFfTgXRSOUawHQHirxpMn\Capace.exe.com
        
        Capace.exe.com l
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Users\Admin\AppData\Roaming\HIgJUuYXnxawtktaHAZhVxcgGJSMBQMsFfTgXRSOUawHQHirxpMn\Capace.exe.com
        
        C:\Users\Admin\AppData\Roaming\HIgJUuYXnxawtktaHAZhVxcgGJSMBQMsFfTgXRSOUawHQHirxpMn\Capace.exe.com l
        7⤵
        Executes dropped EXE
        
        PID:692
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 30
        6⤵
        Runs ping.exe
        
        PID:2268
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\IsyrDCrZ & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\857ab1a996a1b759f32006815532433b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2812-144-0x0000000000400000-0x0000000003DBC000-memory.dmp

Download

memory/3748-142-0x0000000000400000-0x0000000003DBC000-memory.dmp

Download

memory/3748-141-0x00000000001C0000-0x00000000001E6000-memory.dmp

Download

memory/3904-114-0x0000000005B60000-0x0000000005C3F000-memory.dmp

Download

memory/3904-115-0x0000000000400000-0x0000000003E12000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads