Overview
overview
10Static
static
10Mr4X5srRQR...AN.exe
windows10_x64
10OEmxRS9Uai...jI.exe
windows10_x64
10OvVYhhgvd6...oB.exe
windows10_x64
9QKvpJeDIaP...YY.exe
windows10_x64
9QwnNK2SHck...xe.xml
windows10_x64
1QxZsdXOO8X...jN.exe
windows10_x64
10QzUu4XgUxQ...C3.exe
windows10_x64
10SHSPDO6BYD...j9.exe
windows10_x64
10SqCuVl85T1...Di.exe
windows10_x64
10T8Ulrjj8F6..._x.exe
windows10_x64
10Trj0QcTNVE...S9.exe
windows10_x64
10Uwc7l02Hzj...tU.exe
windows10_x64
6VoTrXaqIJ3...LW.exe
windows10_x64
10Wp77te7Dqj...Hr.exe
windows10_x64
9XOCYAkm_Nn...Q3.exe
windows10_x64
9Xd_XnNqsZT...Ai.exe
windows10_x64
10Xr9ca9oQNQ...Z9.exe
windows10_x64
9XukfUfK8HA...FI.exe
windows10_x64
8YPTXDeqMC1...ns.exe
windows10_x64
8ma_5nZD3yo...xT.exe
windows10_x64
10pnDF_dk604...fi.exe
windows10_x64
10q_TzaanAkp...91.exe
windows10_x64
9rgVakr0Eru...xw.exe
windows10_x64
10t1fkwFYUEZ...r4.exe
windows10_x64
10tC6gdsFTgl...3x.exe
windows10_x64
10tGeiUalbSc...xe.xml
windows10_x64
1uMWmES83od...kJ.exe
windows10_x64
10v5n1HuUxta...Iu.exe
windows10_x64
10wTzxLyAQL7...bA.exe
windows10_x64
6xiGD01oEkh...VJ.exe
windows10_x64
10yBqNUgvOW6...Fb.exe
windows10_x64
10Analysis
-
max time kernel
251s -
max time network
264s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
23-08-2021 20:55
Behavioral task
behavioral1
Sample
Mr4X5srRQR20TfuVZShfsrAN.exe
Resource
win10v20210410
Behavioral task
behavioral2
Sample
OEmxRS9UaiMPqIKXPz6Ef8jI.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
OvVYhhgvd6ZhUony5cRMqVoB.exe
Resource
win10v20210410
Behavioral task
behavioral4
Sample
QKvpJeDIaPtXDcwKwH_WmAYY.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
QwnNK2SHckcc_GsoTwi8hDi5.exe.xml
Resource
win10v20210410
Behavioral task
behavioral6
Sample
QxZsdXOO8Xn2bW7iW8ff3gjN.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
QzUu4XgUxQuvhFNx7Nf5D6C3.exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
SHSPDO6BYDV7xlwsZDJxsLj9.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
SqCuVl85T1P8OuH3gpVMKnDi.exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
T8Ulrjj8F65YXJ2qZEm11v_x.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Trj0QcTNVE3l8SBp_3LNLFS9.exe
Resource
win10v20210408
Behavioral task
behavioral12
Sample
Uwc7l02HzjEVLDdBFF3ZKItU.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
VoTrXaqIJ3vc2GnUIU6Wi5LW.exe
Resource
win10v20210408
Behavioral task
behavioral14
Sample
Wp77te7DqjxTjTIGMDSB0RHr.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
XOCYAkm_NnnfPmgVDNgu9MQ3.exe
Resource
win10v20210410
Behavioral task
behavioral16
Sample
Xd_XnNqsZTJJf8dCq4s_mlAi.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
Xr9ca9oQNQWbUwEgChRmX6Z9.exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
XukfUfK8HAbjc5wMknHwOhFI.exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
YPTXDeqMC118ip3zHbyxwlns.exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
ma_5nZD3yos0uV8jzHnJSVxT.exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
pnDF_dk604_fxVsUaLPL1Vfi.exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
q_TzaanAkp60Doa2Vt025l91.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
rgVakr0EruC2FtauFmrgXkxw.exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
t1fkwFYUEZVXvf_7oFFpVnr4.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
tC6gdsFTgl9CBMrK_2QhZX3x.exe
Resource
win10v20210410
Behavioral task
behavioral26
Sample
tGeiUalbScQ8sPK2KKmKZNga.exe.xml
Resource
win10v20210410
Behavioral task
behavioral27
Sample
uMWmES83oduRUCtOU5jzfQkJ.exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
v5n1HuUxtaYNHT7sRlXCCwIu.exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
wTzxLyAQL7H5FI0GIaor5FbA.exe
Resource
win10v20210410
Behavioral task
behavioral30
Sample
xiGD01oEkhh5s50F0Mw8lPVJ.exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
yBqNUgvOW6iDky2dKdBCi5Fb.exe
Resource
win10v20210410
General
-
Target
XOCYAkm_NnnfPmgVDNgu9MQ3.exe
-
Size
5.3MB
-
MD5
083da7bfea93dcaac5ca4c910c0c9636
-
SHA1
5d94f9e397441ee8bb733122f9dce827b80f7e96
-
SHA256
c06817143741717add66241dcd4f1b6ce497c6242d78793a69661b47a3796535
-
SHA512
067b5940f3c04bbe908e978b735818cc6e46f8a34a6dfffdf63eca062b855d19a83f12e351dcb5da81464981771bb2a717d39bed9abdd96087cf4cd2996b31b5
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
XOCYAkm_NnnfPmgVDNgu9MQ3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XOCYAkm_NnnfPmgVDNgu9MQ3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XOCYAkm_NnnfPmgVDNgu9MQ3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral15/memory/2116-116-0x0000000000F30000-0x0000000000F31000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
XOCYAkm_NnnfPmgVDNgu9MQ3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XOCYAkm_NnnfPmgVDNgu9MQ3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
XOCYAkm_NnnfPmgVDNgu9MQ3.exepid process 2116 XOCYAkm_NnnfPmgVDNgu9MQ3.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
XOCYAkm_NnnfPmgVDNgu9MQ3.exepid process 2116 XOCYAkm_NnnfPmgVDNgu9MQ3.exe 2116 XOCYAkm_NnnfPmgVDNgu9MQ3.exe 2116 XOCYAkm_NnnfPmgVDNgu9MQ3.exe 2116 XOCYAkm_NnnfPmgVDNgu9MQ3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
XOCYAkm_NnnfPmgVDNgu9MQ3.exedescription pid process Token: SeDebugPrivilege 2116 XOCYAkm_NnnfPmgVDNgu9MQ3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XOCYAkm_NnnfPmgVDNgu9MQ3.exe"C:\Users\Admin\AppData\Local\Temp\XOCYAkm_NnnfPmgVDNgu9MQ3.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-114-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2116-116-0x0000000000F30000-0x0000000000F31000-memory.dmpFilesize
4KB
-
memory/2116-118-0x0000000005E70000-0x0000000005E71000-memory.dmpFilesize
4KB
-
memory/2116-119-0x0000000006980000-0x0000000006981000-memory.dmpFilesize
4KB
-
memory/2116-120-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/2116-121-0x0000000003730000-0x0000000003731000-memory.dmpFilesize
4KB
-
memory/2116-122-0x0000000005CA0000-0x0000000005CA1000-memory.dmpFilesize
4KB
-
memory/2116-123-0x00000000063B0000-0x00000000063B1000-memory.dmpFilesize
4KB
-
memory/2116-124-0x0000000005970000-0x0000000005E6E000-memory.dmpFilesize
5.0MB
-
memory/2116-125-0x00000000064F0000-0x00000000064F1000-memory.dmpFilesize
4KB
-
memory/2116-126-0x0000000008D30000-0x0000000008D31000-memory.dmpFilesize
4KB
-
memory/2116-127-0x0000000009430000-0x0000000009431000-memory.dmpFilesize
4KB
-
memory/2116-128-0x0000000008F00000-0x0000000008F01000-memory.dmpFilesize
4KB
-
memory/2116-129-0x0000000008FA0000-0x0000000008FA1000-memory.dmpFilesize
4KB
-
memory/2116-130-0x00000000092F0000-0x00000000092F1000-memory.dmpFilesize
4KB
-
memory/2116-131-0x0000000009360000-0x0000000009361000-memory.dmpFilesize
4KB