Analysis
- max time kernel
110s - max time network
119s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
08/01/2022, 15:59
General
- Target 20a4fb50d23656551638133aa3cb49dc.exe
- Size 665KB
- Sample220108-te3beadeel
- SHA256 123f3e76c54fff0e2b50c7a5501b5d531ad16c6eebe301d52a72ba6f7d4efd8a
Malware Config
Signatures
- suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20a4fb50d23656551638133aa3cb49dc.exe"C:\Users\Admin\AppData\Local\Temp\20a4fb50d23656551638133aa3cb49dc.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Green\neofim.exeneofim.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2336-116-0x00000000048E0000-0x00000000049AE000-memory.dmp
memory/2336-117-0x0000000000400000-0x0000000002BDC000-memory.dmp
memory/2336-115-0x0000000004810000-0x000000000487B000-memory.dmp
memory/3176-128-0x00000000025C0000-0x00000000025F2000-memory.dmp
memory/3176-132-0x0000000002593000-0x0000000002594000-memory.dmp
memory/3176-123-0x00000000001C0000-0x00000000001F9000-memory.dmp
memory/3176-124-0x0000000000400000-0x000000000047A000-memory.dmp
memory/3176-125-0x0000000002592000-0x0000000002593000-memory.dmp
memory/3176-126-0x0000000002590000-0x0000000002591000-memory.dmp
memory/3176-127-0x0000000004B60000-0x000000000505E000-memory.dmp
memory/3176-129-0x0000000005080000-0x0000000005686000-memory.dmp
memory/3176-130-0x0000000005710000-0x0000000005722000-memory.dmp
memory/3176-131-0x0000000005740000-0x000000000584A000-memory.dmp
memory/3176-122-0x0000000002330000-0x0000000002364000-memory.dmp
memory/3176-133-0x0000000005890000-0x00000000058CE000-memory.dmp
memory/3176-134-0x00000000058E0000-0x000000000592B000-memory.dmp
memory/3176-135-0x0000000002594000-0x0000000002596000-memory.dmp
memory/3176-136-0x0000000005B80000-0x0000000005BE6000-memory.dmp
memory/3176-137-0x0000000006230000-0x00000000062A6000-memory.dmp
memory/3176-138-0x00000000062E0000-0x0000000006372000-memory.dmp
memory/3176-139-0x00000000063D0000-0x00000000063EE000-memory.dmp
memory/3176-140-0x0000000006700000-0x00000000068C2000-memory.dmp
memory/3176-141-0x00000000068D0000-0x0000000006DFC000-memory.dmp