Analysis
- max time kernel
78s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
01/01/2022, 22:53
General
- Target 61580ab870985a0f2d74da4bda82c0a2.exe
- Size 713KB
- Sample220101-2tywjagdgn
- SHA256 2c49fcbd5eda5275d8d2ef98ee7e0c63d978b6d904e3e750ea9d01e52fe16ce9
Malware Config
Signatures
- suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61580ab870985a0f2d74da4bda82c0a2.exe"C:\Users\Admin\AppData\Local\Temp\61580ab870985a0f2d74da4bda82c0a2.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Green\neofit.exeneofit.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1176-128-0x0000000002770000-0x0000000002782000-memory.dmp
memory/1176-124-0x00000000023D0000-0x0000000002404000-memory.dmp
memory/1176-141-0x00000000066A0000-0x0000000006BCC000-memory.dmp
memory/1176-140-0x00000000064D0000-0x0000000006692000-memory.dmp
memory/1176-122-0x00000000001C0000-0x00000000001F9000-memory.dmp
memory/1176-123-0x0000000000400000-0x0000000000485000-memory.dmp
memory/1176-129-0x0000000005720000-0x000000000582A000-memory.dmp
memory/1176-125-0x0000000004C10000-0x000000000510E000-memory.dmp
memory/1176-126-0x0000000002680000-0x00000000026B2000-memory.dmp
memory/1176-127-0x0000000005110000-0x0000000005716000-memory.dmp
memory/1176-139-0x00000000062A0000-0x00000000062BE000-memory.dmp
memory/1176-134-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/1176-132-0x0000000002883000-0x0000000002884000-memory.dmp
memory/1176-130-0x0000000002880000-0x0000000002881000-memory.dmp
memory/1176-133-0x0000000002884000-0x0000000002886000-memory.dmp
memory/1176-131-0x0000000002882000-0x0000000002883000-memory.dmp
memory/1176-135-0x0000000002830000-0x000000000287B000-memory.dmp
memory/1176-136-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/1176-137-0x0000000006100000-0x0000000006176000-memory.dmp
memory/1176-138-0x00000000061B0000-0x0000000006242000-memory.dmp
memory/2580-115-0x0000000000684000-0x00000000006F0000-memory.dmp
memory/2580-117-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2580-116-0x00000000004E0000-0x000000000062A000-memory.dmp