Analysis
- max time kernel
4265061s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
17/01/2022, 09:35
General
- Target 210755a28439264027c3ad765b4c4333.exe
- Size 645KB
- Sample220117-lkhj7ahcc9
- SHA256 fa38a8bfa024e668a67198bb86add37c4c3b080295b078f9b5e5fe92709b8adc
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\210755a28439264027c3ad765b4c4333.exe"C:\Users\Admin\AppData\Local\Temp\210755a28439264027c3ad765b4c4333.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Green\neofit.exeneofit.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 13323⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3964 -ip 39641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1400-131-0x0000000002400000-0x00000000024CE000-memory.dmp
memory/1400-132-0x0000000000400000-0x000000000062B000-memory.dmp
memory/1400-130-0x000000000086C000-0x00000000008D8000-memory.dmp
memory/3964-142-0x0000000004DE0000-0x0000000005384000-memory.dmp
memory/3964-144-0x0000000004CB0000-0x0000000004CC2000-memory.dmp
memory/3964-137-0x0000000000650000-0x0000000000689000-memory.dmp
memory/3964-138-0x0000000000400000-0x00000000004F4000-memory.dmp
memory/3964-140-0x0000000004DD2000-0x0000000004DD3000-memory.dmp
memory/3964-139-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/3964-141-0x0000000004DD3000-0x0000000004DD4000-memory.dmp
memory/3964-143-0x0000000005390000-0x00000000059A8000-memory.dmp
memory/3964-136-0x00000000006E8000-0x0000000000714000-memory.dmp
memory/3964-145-0x00000000059B0000-0x0000000005ABA000-memory.dmp
memory/3964-146-0x0000000004CF0000-0x0000000004D2C000-memory.dmp
memory/3964-147-0x0000000004DD4000-0x0000000004DD6000-memory.dmp
memory/3964-148-0x0000000005D00000-0x0000000005D92000-memory.dmp
memory/3964-149-0x0000000005DA0000-0x0000000005E16000-memory.dmp
memory/3964-150-0x0000000005E90000-0x0000000005EAE000-memory.dmp
memory/3964-151-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/3964-152-0x0000000006860000-0x0000000006A22000-memory.dmp
memory/3964-153-0x0000000006A30000-0x0000000006F5C000-memory.dmp