95f5464f22e6bbe285c912f7afd00836c7253babdf6b608cbbb5a063bb1f868f

Analysis

max time kernel
142s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
24/06/2021, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B9EAA111AF615EA3D8FD0D2175F27B8B.exe
Size 1.7MB
Sample210624-ftvxfl8gtn
SHA256 95f5464f22e6bbe285c912f7afd00836c7253babdf6b608cbbb5a063bb1f868f
MD5 b9eaa111af615ea3d8fd0d2175f27b8b
SHA1 0cd2c68a0c17879e662addaca297917e8062ffd7
SHA512 cb2777f1cf983fc5e584f3814a15b5b9ee29e0bc7b693aee159c3391ee7a2b9a1821ffd3d407226759c369cd3b790598dbaf2ead5c9cc3f0a5689da384558381
MD5 SHA1 SHA512

Score

10^/10

spyware stealer

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/2608-136-0x0000000006B40000-0x0000000006B42000-memory.dmp	disable_win_def

Executes dropped EXE 1 IoCs

pid	Process
2608	WmiPrvSE.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
16	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wbem\WmiPerfInst\WmiPrvSE.exe	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
File created	C:\Windows\SysWOW64\wbem\WmiPerfInst\24dbde2999530ef5fd907494bc374d663924116c	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
File created	C:\Windows\SysWOW64\wbem\mofd\WMIADAP.exe	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
File created	C:\Windows\SysWOW64\wbem\mofd\75a57c1bdf437c0c81ad56e81f43c7323ed35745	B9EAA111AF615EA3D8FD0D2175F27B8B.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv\OfficeClickToRun.exe	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv\e6c9b481da804f07baff8eff543b0a1441069b5d	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\taskhostw.exe	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	B9EAA111AF615EA3D8FD0D2175F27B8B.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3872	schtasks.exe
2160	schtasks.exe
2496	schtasks.exe
3984	schtasks.exe
1648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
Token: SeDebugPrivilege	2608	WmiPrvSE.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe
2608	WmiPrvSE.exe
2608	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3872	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	78
PID 1868 wrote to memory of 3872	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	78
PID 1868 wrote to memory of 3872	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	78
PID 1868 wrote to memory of 2160	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	80
PID 1868 wrote to memory of 2160	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	80
PID 1868 wrote to memory of 2160	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	80
PID 1868 wrote to memory of 2496	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	82
PID 1868 wrote to memory of 2496	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	82
PID 1868 wrote to memory of 2496	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	82
PID 1868 wrote to memory of 3984	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	84
PID 1868 wrote to memory of 3984	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	84
PID 1868 wrote to memory of 3984	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	84
PID 1868 wrote to memory of 1648	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	86
PID 1868 wrote to memory of 1648	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	86
PID 1868 wrote to memory of 1648	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	86
PID 1868 wrote to memory of 2608	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	88
PID 1868 wrote to memory of 2608	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	88
PID 1868 wrote to memory of 2608	1868	B9EAA111AF615EA3D8FD0D2175F27B8B.exe	88

C:\Users\Admin\AppData\Local\Temp\B9EAA111AF615EA3D8FD0D2175F27B8B.exe
"C:\Users\Admin\AppData\Local\Temp\B9EAA111AF615EA3D8FD0D2175F27B8B.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3872
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WmiPerfInst\WmiPrvSE.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2160
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\System32\wbem\mofd\WMIADAP.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2496
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv\OfficeClickToRun.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3984
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\taskhostw.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1648
- C:\Windows\SysWOW64\wbem\WmiPerfInst\WmiPrvSE.exe
  "C:\Windows\System32\wbem\WmiPerfInst\WmiPrvSE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-116-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

Download

memory/1868-117-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/1868-118-0x00000000055A0000-0x00000000055A1000-memory.dmp

Download

memory/1868-119-0x0000000006150000-0x0000000006151000-memory.dmp

Download

memory/1868-114-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/2608-134-0x0000000006BA0000-0x0000000006BA1000-memory.dmp

Download

memory/2608-128-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/2608-132-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/2608-135-0x0000000006B10000-0x0000000006B15000-memory.dmp

Download

memory/2608-136-0x0000000006B40000-0x0000000006B42000-memory.dmp

Download

memory/2608-137-0x0000000006B80000-0x0000000006B84000-memory.dmp

Download

memory/2608-139-0x00000000070A0000-0x00000000070A1000-memory.dmp

Download

memory/2608-138-0x0000000006B90000-0x0000000006B92000-memory.dmp

Download

memory/2608-140-0x00000000070B0000-0x00000000070B2000-memory.dmp

Download