ae32233ca2a4c0ffb03a6da6154ff2610fe445bdfd8619948b09117ca44ee30b

Analysis

max time kernel
18s
max time network
135s
platform
windows10_x64
resource
win10v20210410
submitted
26/06/2021, 05:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TOTOTOTO.bin.exe
Size 2.9MB
Sample210626-n4p136b4be
SHA256 ae32233ca2a4c0ffb03a6da6154ff2610fe445bdfd8619948b09117ca44ee30b
MD5 e1ed8dc6958fbd9e09a14ddff49874e5
SHA1 77a28723ed48bea09b1f230b47efb30be1e0a6e8
SHA512 aba28c83bb0264074359dfbe31559968d07d14e142675cf66c722baa0ee1836b8017b2fa5cef2eec866df01dace84b81cdd53e3bd26d8c85b72b3b7c948b2ada
MD5 SHA1 SHA512

Score

9^/10

spyware stealer upx

Malware Config

Signatures

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4052-124-0x00000290DE410000-0x00000290DE74B000-memory.dmp	WebBrowserPassView
behavioral2/files/0x000100000001ab37-151.dat	WebBrowserPassView
behavioral2/files/0x000100000001ab37-152.dat	WebBrowserPassView

Nirsoft 9 IoCs

resource	yara_rule
behavioral2/memory/4052-124-0x00000290DE410000-0x00000290DE74B000-memory.dmp	Nirsoft
behavioral2/files/0x000100000001ab32-143.dat	Nirsoft
behavioral2/files/0x000100000001ab32-144.dat	Nirsoft
behavioral2/files/0x000100000001ab37-151.dat	Nirsoft
behavioral2/files/0x000100000001ab37-152.dat	Nirsoft
behavioral2/files/0x000100000001ab34-166.dat	Nirsoft
behavioral2/files/0x000100000001ab34-165.dat	Nirsoft
behavioral2/files/0x000100000001ab36-174.dat	Nirsoft
behavioral2/files/0x000100000001ab36-175.dat	Nirsoft

Executes dropped EXE 7 IoCs

pid	Process
4052	RtkBtManServ.exe
364	bfsvc.exe
1284	snuvcdsm.exe
348	winhlp32.exe
2116	splwow64.exe
2192	hh.exe
3948	xwizard.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000001ab33-159.dat	upx
behavioral2/files/0x000100000001ab33-160.dat	upx
behavioral2/files/0x000100000001ab35-162.dat	upx
behavioral2/files/0x000100000001ab35-163.dat	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	RtkBtManServ.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1284	snuvcdsm.exe
1284	snuvcdsm.exe
1284	snuvcdsm.exe
1284	snuvcdsm.exe
2192	hh.exe
2192	hh.exe
3948	xwizard.exe
3948	xwizard.exe
3948	xwizard.exe
3948	xwizard.exe
3948	xwizard.exe
3948	xwizard.exe
3948	xwizard.exe
3948	xwizard.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	RtkBtManServ.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 4052	1808	TOTOTOTO.bin.exe	76
PID 1808 wrote to memory of 4052	1808	TOTOTOTO.bin.exe	76
PID 4052 wrote to memory of 1216	4052	RtkBtManServ.exe	79
PID 4052 wrote to memory of 1216	4052	RtkBtManServ.exe	79
PID 1216 wrote to memory of 2816	1216	WScript.exe	80
PID 1216 wrote to memory of 2816	1216	WScript.exe	80
PID 2816 wrote to memory of 364	2816	cmd.exe	82
PID 2816 wrote to memory of 364	2816	cmd.exe	82
PID 2816 wrote to memory of 364	2816	cmd.exe	82
PID 4052 wrote to memory of 2792	4052	RtkBtManServ.exe	84
PID 4052 wrote to memory of 2792	4052	RtkBtManServ.exe	84
PID 2792 wrote to memory of 3772	2792	WScript.exe	85
PID 2792 wrote to memory of 3772	2792	WScript.exe	85
PID 3772 wrote to memory of 1284	3772	cmd.exe	87
PID 3772 wrote to memory of 1284	3772	cmd.exe	87
PID 3772 wrote to memory of 1284	3772	cmd.exe	87
PID 4052 wrote to memory of 1012	4052	RtkBtManServ.exe	88
PID 4052 wrote to memory of 1012	4052	RtkBtManServ.exe	88
PID 1012 wrote to memory of 3992	1012	WScript.exe	89
PID 1012 wrote to memory of 3992	1012	WScript.exe	89
PID 3992 wrote to memory of 348	3992	cmd.exe	91
PID 3992 wrote to memory of 348	3992	cmd.exe	91
PID 3992 wrote to memory of 348	3992	cmd.exe	91
PID 3992 wrote to memory of 2116	3992	cmd.exe	92
PID 3992 wrote to memory of 2116	3992	cmd.exe	92
PID 3992 wrote to memory of 2116	3992	cmd.exe	92
PID 3992 wrote to memory of 2192	3992	cmd.exe	93
PID 3992 wrote to memory of 2192	3992	cmd.exe	93
PID 3992 wrote to memory of 2192	3992	cmd.exe	93
PID 4052 wrote to memory of 2356	4052	RtkBtManServ.exe	94
PID 4052 wrote to memory of 2356	4052	RtkBtManServ.exe	94
PID 2356 wrote to memory of 740	2356	WScript.exe	95
PID 2356 wrote to memory of 740	2356	WScript.exe	95
PID 740 wrote to memory of 3948	740	cmd.exe	97
PID 740 wrote to memory of 3948	740	cmd.exe	97
PID 740 wrote to memory of 3948	740	cmd.exe	97
PID 4052 wrote to memory of 1204	4052	RtkBtManServ.exe	98
PID 4052 wrote to memory of 1204	4052	RtkBtManServ.exe	98
PID 1204 wrote to memory of 2812	1204	cmd.exe	100
PID 1204 wrote to memory of 2812	1204	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\TOTOTOTO.bin.exe
"C:\Users\Admin\AppData\Local\Temp\TOTOTOTO.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
  "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs4JB0qFX+bf5HVz5YzKfd4MoE29SwuMZ8+/kcKC/E8Je5D8KIkXoOqJ9SF5T+nfUH5JDbtTIup7ewf9OWyu0j7oLcVrpPSlEJain+3XSbYB01t4RnnRpxMNpa1e8hdjn60=
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
        
        C:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"
        5⤵
        Executes dropped EXE
        
        PID:364
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1284
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
        
        C:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"
        5⤵
        Executes dropped EXE
        
        PID:348
    - - C:\Users\Admin\AppData\Local\Temp\splwow64.exe
        
        C:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"
        5⤵
        Executes dropped EXE
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\hh.exe
        
        C:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2192
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\xwizard.exe
        
        C:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3948
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-118-0x00000000053C0000-0x00000000053C1000-memory.dmp

Download

memory/1808-116-0x00000000059D0000-0x00000000059D1000-memory.dmp

Download

memory/1808-114-0x0000000000150000-0x0000000000151000-memory.dmp

Download

memory/1808-117-0x0000000005640000-0x0000000005641000-memory.dmp

Download

memory/4052-130-0x00000290DF240000-0x00000290DF241000-memory.dmp

Download

memory/4052-128-0x00000290C4230000-0x00000290C4232000-memory.dmp

Download

memory/4052-136-0x00000290DF2B0000-0x00000290DF2B1000-memory.dmp

Download

memory/4052-125-0x00000290C4240000-0x00000290C4241000-memory.dmp

Download

memory/4052-124-0x00000290DE410000-0x00000290DE74B000-memory.dmp

Download

memory/4052-131-0x00000290C5BC0000-0x00000290C5BEA000-memory.dmp

Download

memory/4052-122-0x00000290C3BF0000-0x00000290C3BF1000-memory.dmp

Download

memory/4052-132-0x00000290C5C70000-0x00000290C5C76000-memory.dmp

Download

memory/4052-133-0x00000290DF270000-0x00000290DF271000-memory.dmp

Download

memory/4052-134-0x00000290DF210000-0x00000290DF23F000-memory.dmp

Download

memory/4052-127-0x00000290C5C90000-0x00000290C5D3C000-memory.dmp

Download

memory/4052-135-0x00000290DF2C0000-0x00000290DF35B000-memory.dmp

Download

memory/4052-137-0x00000290DF390000-0x00000290DF391000-memory.dmp

Download

memory/4052-126-0x00000290C5BF0000-0x00000290C5BF1000-memory.dmp

Download