Overview

overview

8

Static

static

3

c299cc09ab...bb.exe

windows7_x64

8

c299cc09ab...bb.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16-05-2022 02:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe

  • Size

    5.2MB

  • MD5

    1602e66dbf6c6d9d42fff718a0bdc84e

  • SHA1

    4fff705808153dd10f5a4d0622f5356634c72084

  • SHA256

    c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb

  • SHA512

    fff54e662ae1f753070781d0330d41276eafda1b25b3bd2bd478656fb28561c534b3a73723a2273917e3f4df9307dc9b35ae107966369cf8705ac4220c6a74a0

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe
    "C:\Users\Admin\AppData\Local\Temp\c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe
      "C:\Users\Admin\AppData\Local\Temp\c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4660
        • C:\Windows\system32\reg.exe
          REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1
          4⤵
            PID:3852
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink" /Q
          3⤵
            PID:520
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\ApproveBackup.m1v" /Q
            3⤵
              PID:372
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\AssertCompress.pcx" /Q
              3⤵
                PID:2164
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\ConfirmInstall.scf" /Q
                3⤵
                  PID:4552
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\ConvertFromLock.mhtml" /Q
                  3⤵
                    PID:5104
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\DisableUninstall.wmf" /Q
                    3⤵
                      PID:4756
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\DismountDisable.png" /Q
                      3⤵
                        PID:3404
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\FindConvert.ADT" /Q
                        3⤵
                          PID:204
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\GrantClose.dib" /Q
                          3⤵
                            PID:1568
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\InvokeTrace.3gp2" /Q
                            3⤵
                              PID:2064
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\Microsoft Edge.lnk" /Q
                              3⤵
                                PID:2596
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\OutSwitch.bin" /Q
                                3⤵
                                  PID:3312
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\PingEdit.wmf" /Q
                                  3⤵
                                    PID:1548
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\PingUse.vsx" /Q
                                    3⤵
                                      PID:4612
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\RedoRegister.html" /Q
                                      3⤵
                                        PID:4972
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\RemoveConvertTo.css" /Q
                                        3⤵
                                          PID:3556
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\RestartLimit.wmx" /Q
                                          3⤵
                                            PID:3368
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\SearchProtect.contact" /Q
                                            3⤵
                                              PID:4484
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\SelectSplit.rtf" /Q
                                              3⤵
                                                PID:2872
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\SetPop.eps" /Q
                                                3⤵
                                                  PID:2948
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\SplitOpen.dll" /Q
                                                  3⤵
                                                    PID:4904
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\StepRequest.m4a" /Q
                                                    3⤵
                                                      PID:1308
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\StopConfirm.rtf" /Q
                                                      3⤵
                                                        PID:3096
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\UninstallPush.bat" /Q
                                                        3⤵
                                                          PID:2896
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\UnregisterRestart.emf" /Q
                                                          3⤵
                                                            PID:1880
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Desktop\UseReset.TS" /Q
                                                            3⤵
                                                              PID:2212
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\Links\Desktop.lnk" /Q
                                                              3⤵
                                                                PID:4312
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c del "C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink" /Q
                                                                3⤵
                                                                  PID:2444
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c del "C:\Users\Public\Desktop\Acrobat Reader DC.lnk" /Q
                                                                  3⤵
                                                                    PID:1140
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c del "C:\Users\Public\Desktop\Firefox.lnk" /Q
                                                                    3⤵
                                                                      PID:1180
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c del "C:\Users\Public\Desktop\Google Chrome.lnk" /Q
                                                                      3⤵
                                                                        PID:3572
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c del "C:\Users\Public\Desktop\VLC media player.lnk" /Q
                                                                        3⤵
                                                                          PID:2408
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\autorun.nrx" C:\Windows\System32\autorun.nrx
                                                                          3⤵
                                                                          • Drops file in System32 directory
                                                                          PID:3972
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\worm2.jpg" C:\Windows\System32\worm2.jpg
                                                                          3⤵
                                                                            PID:4708
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\Neurax.exe" C:\Windows\System32\Neurax.exe
                                                                            3⤵
                                                                              PID:4432
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v Neurax /t REG_SZ /d "C:\Windows\System32\Neurax.exe"
                                                                              3⤵
                                                                                PID:4976
                                                                                • C:\Windows\system32\reg.exe
                                                                                  REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v Neurax /t REG_SZ /d "C:\Windows\System32\Neurax.exe"
                                                                                  4⤵
                                                                                  • Adds Run key to start application
                                                                                  PID:4952
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c shutdown /r
                                                                                3⤵
                                                                                  PID:2056
                                                                                  • C:\Windows\system32\shutdown.exe
                                                                                    shutdown /r
                                                                                    4⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5048
                                                                            • C:\Windows\system32\LogonUI.exe
                                                                              "LogonUI.exe" /flags:0x4 /state0:0xa3959055 /state1:0x41c64e6d
                                                                              1⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4268

                                                                            Network

                                                                            MITRE ATT&CK Matrix ATT&CK v6

                                                                            Initial Access

                                                                            Execution

                                                                            Persistence

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1060

                                                                            Privilege Escalation

                                                                            Defense Evasion

                                                                            Modify Registry

                                                                            1
                                                                            T1112

                                                                            Credential Access

                                                                            Credentials in Files

                                                                            1
                                                                            T1081

                                                                            Discovery

                                                                            Lateral Movement

                                                                            Collection

                                                                            Data from Local System

                                                                            1
                                                                            T1005

                                                                            Exfiltration

                                                                            Command and Control

                                                                            Impact

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10842\Neurax.exe.manifest
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              e2579e73fb1c89963e61f8bc5a684cd1

                                                                              SHA1

                                                                              71541f76cb551ba619f46c5f28df06d29cce77a2

                                                                              SHA256

                                                                              8afa8a79744dc52faea860e68caa311f15f37734de3494643ed04e748e475cd9

                                                                              SHA512

                                                                              9a6cea355d9825748c17b4df3574c015b07420276e460157dcf4b26da227caf8914aafdfc1f2443e16e2c6ba115258337a4fb10970e24f2188e157810a331d95

                                                                              Download Submit
                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10842\VCRUNTIME140.dll
                                                                              Filesize

                                                                              87KB

                                                                              MD5

                                                                              0e675d4a7a5b7ccd69013386793f68eb

                                                                              SHA1

                                                                              6e5821ddd8fea6681bda4448816f39984a33596b

                                                                              SHA256

                                                                              bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

                                                                              SHA512

                                                                              cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

                                                                              Download Submit
                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10842\VCRUNTIME140.dll
                                                                              Filesize

                                                                              87KB

                                                                              MD5

                                                                              0e675d4a7a5b7ccd69013386793f68eb

                                                                              SHA1

                                                                              6e5821ddd8fea6681bda4448816f39984a33596b

                                                                              SHA256

                                                                              bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

                                                                              SHA512

                                                                              cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

                                                                              Download Submit
                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10842\_ctypes.pyd
                                                                              Filesize

                                                                              129KB

                                                                              MD5

                                                                              2f21f50d2252e3083555a724ca57b71e

                                                                              SHA1

                                                                              49ec351d569a466284b8cc55ee9aeaf3fbf20099

                                                                              SHA256

                                                                              09887f07f4316057d3c87e3a907c2235dc6547e54ed4f5f9125f99e547d58bce

                                                                              SHA512

                                                                              e71ff1e63105f51a4516498cd09f8156d7208758c5dc9a74e7654844e5cefc6e84f8fe98a1f1bd7a459a98965fbe913cb5edb552fffa1e33dfda709f918dddeb

                                                                              Download Submit
                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10842\_ctypes.pyd
                                                                              Filesize

                                                                              129KB

                                                                              MD5

                                                                              2f21f50d2252e3083555a724ca57b71e

                                                                              SHA1

                                                                              49ec351d569a466284b8cc55ee9aeaf3fbf20099

                                                                              SHA256

                                                                              09887f07f4316057d3c87e3a907c2235dc6547e54ed4f5f9125f99e547d58bce

                                                                              SHA512

                                                                              e71ff1e63105f51a4516498cd09f8156d7208758c5dc9a74e7654844e5cefc6e84f8fe98a1f1bd7a459a98965fbe913cb5edb552fffa1e33dfda709f918dddeb

                                                                              Download Submit
                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10842\base_library.zip
                                                                              Filesize

                                                                              766KB

                                                                              MD5

                                                                              b48d9123e8ff01087d28f2c2acc1643f

                                                                              SHA1

                                                                              2058a1779bcee55dd4e62096e1303371855f1624

                                                                              SHA256

                                                                              75cc1a3b419d5f1116b7afceef199e12ad3f56c3164c2e9aeb51a7be8dd39785

                                                                              SHA512

                                                                              229c08111b7c57154e27da0a5ef61945aeb98f2287f3bec4f32bdd0f898861dbf46750d54ecb2f5930985ce30360e474780fd8254b8702375146cf7529d5e987

                                                                              Download Submit
                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10842\python37.dll
                                                                              Filesize

                                                                              3.7MB

                                                                              MD5

                                                                              62125a78b9be5ac58c3b55413f085028

                                                                              SHA1

                                                                              46c643f70dd3b3e82ab4a5d1bc979946039e35b2

                                                                              SHA256

                                                                              17c29e6188b022f795092d72a1fb58630a7c723d70ac5bc3990b20cd2eb2a51f

                                                                              SHA512

                                                                              e63f4aa8fc5cd1569ae401e283bc8e1445859131eb0db76581b941f1085670c549cbc3fedf911a21c1237b0f3f66f62b10c60e88b923fa058f7fafee18dd0fa4

                                                                              Download Submit
                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10842\python37.dll
                                                                              Filesize

                                                                              3.7MB

                                                                              MD5

                                                                              62125a78b9be5ac58c3b55413f085028

                                                                              SHA1

                                                                              46c643f70dd3b3e82ab4a5d1bc979946039e35b2

                                                                              SHA256

                                                                              17c29e6188b022f795092d72a1fb58630a7c723d70ac5bc3990b20cd2eb2a51f

                                                                              SHA512

                                                                              e63f4aa8fc5cd1569ae401e283bc8e1445859131eb0db76581b941f1085670c549cbc3fedf911a21c1237b0f3f66f62b10c60e88b923fa058f7fafee18dd0fa4

                                                                              Download Submit
                                                                            • C:\Users\Admin\AppData\Local\Temp\autorun.nrx
                                                                              Filesize

                                                                              61B

                                                                              MD5

                                                                              17b7e747e7579c2b52c1489e2786788c

                                                                              SHA1

                                                                              0d923c9024970265495a6d3c2855abeb8381ee52

                                                                              SHA256

                                                                              980de193f5adf9eecd04710974c0f34faa7c15c310ecb91e8cbaf54890d06499

                                                                              SHA512

                                                                              b9f30849505e13080317c9ca521e4f3546705c1c19a603b11156beaa94a9b82e2c601b6b48dd1743e7ecbb4efa8d40577b6cc7e41bda4ae9953daa99b2570b89

                                                                              Download Submit
                                                                            • memory/204-148-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/372-142-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/520-141-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/1140-169-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/1180-170-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/1308-162-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/1548-153-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/1568-149-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/1880-165-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2056-179-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2064-150-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2164-143-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2212-166-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2408-172-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2444-168-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2596-151-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2872-159-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2896-164-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/2948-160-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/3096-163-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/3312-152-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/3368-157-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/3404-147-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/3556-156-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/3572-171-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/3852-140-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/3972-173-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4264-130-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4312-167-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4432-176-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4484-158-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4552-144-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4612-154-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4660-139-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4708-175-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4756-146-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4904-161-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4952-178-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4972-155-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/4976-177-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/5048-180-0x0000000000000000-mapping.dmp
                                                                              Download
                                                                            • memory/5104-145-0x0000000000000000-mapping.dmp
                                                                              Download