b44e19a6c5eb8c470abccab829b415f5a81d212cae9b9f2fc3d349a06978a4d4

General

Target

Main__Setup.exe
Size

750.0MB
MD5

0acc6b030f96957830f7b9dc92023a12
SHA1

86fc468e5d074433e84ed450f5d5bb78b1f17011
SHA256

6efa533a39cda08148230e64ead2ee1b48418891fb69bd2fe87a53abee37ff71
SHA512

ffd44734269fcdb2408cd3f90afb73bd642162831b1c19b0f13bd6be0d5796ebadd9d94166be2bfa2e64417d450f1d96609cee2b3407a767fff47bfe49543cf9

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/4460-133-0x0000000000400000-0x0000000000547000-memory.dmp	autoit_exe
behavioral2/memory/4460-134-0x0000000000400000-0x0000000000547000-memory.dmp	autoit_exe
behavioral2/memory/4460-135-0x0000000000400000-0x0000000000547000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Main__Setup.exe

description pid process target process

PID 368 set thread context of 4460 368 Main__Setup.exe Main__Setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
NTFS ADS 1 IoCs

Processes:

Main__Setup.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2 Main__Setup.exe

description	pid	process	target process
PID 368 set thread context of 4460	368	Main__Setup.exe	Main__Setup.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2	Main__Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Main__Setup.exeMain__Setup.exe

pid	process
368	Main__Setup.exe
368	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe
4460	Main__Setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Main__Setup.exe

description pid process

Token: SeDebugPrivilege 368 Main__Setup.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Main__Setup.exe

pid process

4460 Main__Setup.exe

description	pid	process
Token: SeDebugPrivilege	368	Main__Setup.exe

pid	process
4460	Main__Setup.exe

Suspicious use of WriteProcessMemory 58 IoCs

Processes:

Main__Setup.exeMain__Setup.exe

description	pid	process	target process
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 368 wrote to memory of 4460	368	Main__Setup.exe	Main__Setup.exe
PID 4460 wrote to memory of 3320	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 3320	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 3320	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4612	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4612	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4612	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1416	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1416	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1416	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1820	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1820	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1820	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 2816	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 2816	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 2816	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4296	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4296	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4296	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 3440	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 3440	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 3440	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 2228	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 2228	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 2228	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4464	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4464	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4464	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4800	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4800	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4800	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 2236	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 2236	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 2236	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1744	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1744	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1744	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 3108	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 3108	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 3108	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1512	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1512	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 1512	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4352	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4352	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4352	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4928	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4928	4460	Main__Setup.exe	cmd.exe
PID 4460 wrote to memory of 4928	4460	Main__Setup.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Main__Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Main__Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368

C:\Users\Admin\AppData\Local\Temp\Main__Setup.exe
C:\Users\Admin\AppData\Local\Temp\Main__Setup.exe
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\Desktop\*.txt" "C:\Users\Admin\AppData\Local\Temp\4673\_Files"
3⤵
PID:3320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\wallet.dat" /S /B /A-D
3⤵
PID:4612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\UTC--2*" /S /B /A-D
3⤵
PID:1416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\4673\_Chrome\default_webdata.db"
3⤵
PID:1820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\4673\_Chrome\default_logins.db"
3⤵
PID:2816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Cookies" "C:\Users\Admin\AppData\Local\Temp\4673\_Chrome\default_cookies.db"
3⤵
PID:4296

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\4673\_Chrome\default_cookies.db"
3⤵
PID:3440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\4673\_Edge\default_webdata.db"
3⤵
PID:2228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\4673\_Edge\default_logins.db"
3⤵
PID:4464

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\4673\_Edge\default_cookies.db"
3⤵
PID:4800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/y5jvqecy.Admin\formhistory.sqlite" "C:\Users\Admin\AppData\Local\Temp\4673\_Firefox\formhistory.sqlite"
3⤵
PID:2236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/y5jvqecy.Admin\cookies.sqlite" "C:\Users\Admin\AppData\Local\Temp\4673\_Firefox\cookies.sqlite"
3⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/y5jvqecy.Admin\signons.sqlite" "C:\Users\Admin\AppData\Local\Temp\4673\_Firefox\signons.sqlite"
3⤵
PID:3108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/y5jvqecy.Admin\logins.json" "C:\Users\Admin\AppData\Local\Temp\4673\_Firefox\logins.json"
3⤵
PID:1512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/y5jvqecy.Admin\key3.db" "C:\Users\Admin\AppData\Local\Temp\4673\_Firefox\key3.db"
3⤵
PID:4352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/y5jvqecy.Admin\key4.db" "C:\Users\Admin\AppData\Local\Temp\4673\_Firefox\key4.db"
3⤵
PID:4928

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4673\_Chrome\default_cookies.db
MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4673\_Chrome\default_logins.db
MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\4673\_Chrome\default_webdata.db
MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\4673\_Edge\default_logins.db
MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\4673\_Edge\default_webdata.db
MD5
780853cddeaee8de70f28a4b255a600b

SHA1
ad7a5da33f7ad12946153c497e990720b09005ed

SHA256
1055ff62de3dea7645c732583242adf4164bdcfb9dd37d9b35bbb9510d59b0a3

SHA512
e422863112084bb8d11c682482e780cd63c2f20c8e3a93ed3b9efd1b04d53eb5d3c8081851ca89b74d66f3d9ab48eb5f6c74550484f46e7c6e460a8250c9b1d8

Download Submit
memory/368-131-0x0000000000D80000-0x0000000000DEA000-memory.dmp

Filesize
424KB

Download
memory/368-132-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/368-130-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4460-137-0x0000000003C70000-0x0000000003C71000-memory.dmp

Filesize
4KB

Download
memory/4460-139-0x0000000003C80000-0x0000000003C81000-memory.dmp

Filesize
4KB

Download
memory/4460-136-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Filesize
4KB

Download
memory/4460-138-0x0000000003C60000-0x0000000003C61000-memory.dmp

Filesize
4KB

Download
memory/4460-135-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/4460-134-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/4460-133-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads