Analysis
-
max time kernel
80s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 02:07
General
-
Target
c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe
-
Size
5.2MB
-
MD5
1602e66dbf6c6d9d42fff718a0bdc84e
-
SHA1
4fff705808153dd10f5a4d0622f5356634c72084
-
SHA256
c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb
-
SHA512
fff54e662ae1f753070781d0330d41276eafda1b25b3bd2bd478656fb28561c534b3a73723a2273917e3f4df9307dc9b35ae107966369cf8705ac4220c6a74a0
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe"C:\Users\Admin\AppData\Local\Temp\c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe"C:\Users\Admin\AppData\Local\Temp\c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 14⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\BackupSelect.cfg" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\BackupSend.ico" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\BlockPop.tiff" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\ConnectSelect.hta" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\CopyConvertFrom.wav" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\DenySync.zip" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\FormatConfirm.inf" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\GrantUnprotect.mpeg3" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\ImportBlock.snd" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\LockResume.asx" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\MoveUnpublish.jpe" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\ReceiveComplete.xltx" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\RepairEdit.ppt" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\RepairInvoke.crw" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\SearchRegister.wmf" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\SelectConvertTo.jtx" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\StartInitialize.au" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\UpdateComplete.doc" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Links\Desktop.lnk" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Public\Desktop\Adobe Reader 9.lnk" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Public\Desktop\Firefox.lnk" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Public\Desktop\Google Chrome.lnk" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Public\Desktop\VLC media player.lnk" /Q3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\autorun.nrx" C:\Windows\System32\autorun.nrx3⤵
- Drops file in System32 directory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\worm2.jpg" C:\Windows\System32\worm2.jpg3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\Neurax.exe" C:\Windows\System32\Neurax.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v Neurax /t REG_SZ /d "C:\Windows\System32\Neurax.exe"3⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v Neurax /t REG_SZ /d "C:\Windows\System32\Neurax.exe"4⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown /r3⤵
-
C:\Windows\system32\shutdown.exeshutdown /r4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI7482\Neurax.exe.manifestFilesize
1KB
MD5e2579e73fb1c89963e61f8bc5a684cd1
SHA171541f76cb551ba619f46c5f28df06d29cce77a2
SHA2568afa8a79744dc52faea860e68caa311f15f37734de3494643ed04e748e475cd9
SHA5129a6cea355d9825748c17b4df3574c015b07420276e460157dcf4b26da227caf8914aafdfc1f2443e16e2c6ba115258337a4fb10970e24f2188e157810a331d95
-
C:\Users\Admin\AppData\Local\Temp\_MEI7482\VCRUNTIME140.dllFilesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
C:\Users\Admin\AppData\Local\Temp\_MEI7482\_ctypes.pydFilesize
129KB
MD52f21f50d2252e3083555a724ca57b71e
SHA149ec351d569a466284b8cc55ee9aeaf3fbf20099
SHA25609887f07f4316057d3c87e3a907c2235dc6547e54ed4f5f9125f99e547d58bce
SHA512e71ff1e63105f51a4516498cd09f8156d7208758c5dc9a74e7654844e5cefc6e84f8fe98a1f1bd7a459a98965fbe913cb5edb552fffa1e33dfda709f918dddeb
-
C:\Users\Admin\AppData\Local\Temp\_MEI7482\base_library.zipFilesize
766KB
MD5b48d9123e8ff01087d28f2c2acc1643f
SHA12058a1779bcee55dd4e62096e1303371855f1624
SHA25675cc1a3b419d5f1116b7afceef199e12ad3f56c3164c2e9aeb51a7be8dd39785
SHA512229c08111b7c57154e27da0a5ef61945aeb98f2287f3bec4f32bdd0f898861dbf46750d54ecb2f5930985ce30360e474780fd8254b8702375146cf7529d5e987
-
C:\Users\Admin\AppData\Local\Temp\_MEI7482\python37.dllFilesize
3.7MB
MD562125a78b9be5ac58c3b55413f085028
SHA146c643f70dd3b3e82ab4a5d1bc979946039e35b2
SHA25617c29e6188b022f795092d72a1fb58630a7c723d70ac5bc3990b20cd2eb2a51f
SHA512e63f4aa8fc5cd1569ae401e283bc8e1445859131eb0db76581b941f1085670c549cbc3fedf911a21c1237b0f3f66f62b10c60e88b923fa058f7fafee18dd0fa4
-
C:\Users\Admin\AppData\Local\Temp\autorun.nrxFilesize
100B
MD538ecd4e05e7fb0bddd0befe1bddac8f3
SHA145a7e3b233d051e0d197582ad7e4535ae2691327
SHA256375768d8613699967fef849313c107164e666a49087a5a9a40ca6e05e9dda825
SHA512a6425ba7c80ff2f03669c06082ccf8a9fb0ae87a6086061a1b47f58ad828b9777ed7e9c577ab2fd56811c84908081b3d7091f5a901ca657b1b2f56e1d06a03b5
-
\Users\Admin\AppData\Local\Temp\_MEI7482\VCRUNTIME140.dllFilesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
\Users\Admin\AppData\Local\Temp\_MEI7482\_ctypes.pydFilesize
129KB
MD52f21f50d2252e3083555a724ca57b71e
SHA149ec351d569a466284b8cc55ee9aeaf3fbf20099
SHA25609887f07f4316057d3c87e3a907c2235dc6547e54ed4f5f9125f99e547d58bce
SHA512e71ff1e63105f51a4516498cd09f8156d7208758c5dc9a74e7654844e5cefc6e84f8fe98a1f1bd7a459a98965fbe913cb5edb552fffa1e33dfda709f918dddeb
-
\Users\Admin\AppData\Local\Temp\_MEI7482\python37.dllFilesize
3.7MB
MD562125a78b9be5ac58c3b55413f085028
SHA146c643f70dd3b3e82ab4a5d1bc979946039e35b2
SHA25617c29e6188b022f795092d72a1fb58630a7c723d70ac5bc3990b20cd2eb2a51f
SHA512e63f4aa8fc5cd1569ae401e283bc8e1445859131eb0db76581b941f1085670c549cbc3fedf911a21c1237b0f3f66f62b10c60e88b923fa058f7fafee18dd0fa4
-
memory/432-97-0x0000000000000000-mapping.dmp
-
memory/520-69-0x0000000000000000-mapping.dmp
-
memory/668-93-0x0000000000000000-mapping.dmp
-
memory/700-71-0x0000000000000000-mapping.dmp
-
memory/764-80-0x0000000000000000-mapping.dmp
-
memory/780-73-0x0000000000000000-mapping.dmp
-
memory/952-83-0x0000000000000000-mapping.dmp
-
memory/1016-82-0x0000000000000000-mapping.dmp
-
memory/1036-89-0x0000000000000000-mapping.dmp
-
memory/1036-67-0x0000000000000000-mapping.dmp
-
memory/1040-92-0x0000000000000000-mapping.dmp
-
memory/1044-95-0x0000000000000000-mapping.dmp
-
memory/1044-76-0x0000000000000000-mapping.dmp
-
memory/1108-70-0x0000000000000000-mapping.dmp
-
memory/1148-98-0x0000000000000000-mapping.dmp
-
memory/1252-72-0x0000000000000000-mapping.dmp
-
memory/1280-81-0x0000000000000000-mapping.dmp
-
memory/1328-79-0x0000000000000000-mapping.dmp
-
memory/1344-84-0x0000000000000000-mapping.dmp
-
memory/1360-74-0x0000000000000000-mapping.dmp
-
memory/1456-90-0x0000000000000000-mapping.dmp
-
memory/1544-78-0x0000000000000000-mapping.dmp
-
memory/1580-68-0x0000000000000000-mapping.dmp
-
memory/1592-86-0x0000000000000000-mapping.dmp
-
memory/1612-96-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmpFilesize
8KB
-
memory/1612-54-0x0000000000000000-mapping.dmp
-
memory/1640-63-0x0000000000000000-mapping.dmp
-
memory/1684-66-0x0000000000000000-mapping.dmp
-
memory/1684-88-0x0000000000000000-mapping.dmp
-
memory/1756-64-0x0000000000000000-mapping.dmp
-
memory/1832-77-0x0000000000000000-mapping.dmp
-
memory/1972-75-0x0000000000000000-mapping.dmp
-
memory/1972-94-0x0000000000000000-mapping.dmp
-
memory/1996-85-0x0000000000000000-mapping.dmp
-
memory/2016-65-0x0000000000000000-mapping.dmp
-
memory/2016-87-0x0000000000000000-mapping.dmp