bf135724716fdb8f935249e97e33949db73caa02b89e7044fc273f4ae630b2d4

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17/05/2022, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05172022.scr.exe
Size 1.8MB
Sample220517-s3715aebc2
SHA256 bf135724716fdb8f935249e97e33949db73caa02b89e7044fc273f4ae630b2d4
MD5 af4ae86bd86b44a438d8a610a8d8801a
SHA1 efd5a60a183b9a840c54210864bd41ee0f959018
SHA512 798e6ffc79d7f2583daa2d11d4649d0428f17983507b05bee020b7ed472827ca6432c6e9229ea275ab1e2225305d8c8aa2343e8fffc131a4f09fe03f1eb5e319
MD5 SHA1 SHA512

Score

10^/10

spyware stealer suricata

Malware Config

Signatures

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	3464	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	3464	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	3464	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	3464	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	3464	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	3464	schtasks.exe	39

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
228	Fontreviewnet.exe
5040	conhost.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	05172022.scr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Fontreviewnet.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4980	schtasks.exe
4576	schtasks.exe
764	schtasks.exe
1820	schtasks.exe
3700	schtasks.exe
1676	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	05172022.scr.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
228	Fontreviewnet.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe
5040	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5040	conhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	Fontreviewnet.exe
Token: SeDebugPrivilege	5040	conhost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2880	4656	05172022.scr.exe	82
PID 4656 wrote to memory of 2880	4656	05172022.scr.exe	82
PID 4656 wrote to memory of 2880	4656	05172022.scr.exe	82
PID 4656 wrote to memory of 4540	4656	05172022.scr.exe	83
PID 4656 wrote to memory of 4540	4656	05172022.scr.exe	83
PID 4656 wrote to memory of 4540	4656	05172022.scr.exe	83
PID 2880 wrote to memory of 1756	2880	WScript.exe	87
PID 2880 wrote to memory of 1756	2880	WScript.exe	87
PID 2880 wrote to memory of 1756	2880	WScript.exe	87
PID 1756 wrote to memory of 228	1756	cmd.exe	89
PID 1756 wrote to memory of 228	1756	cmd.exe	89
PID 228 wrote to memory of 5040	228	Fontreviewnet.exe	97
PID 228 wrote to memory of 5040	228	Fontreviewnet.exe	97

C:\Users\Admin\AppData\Local\Temp\05172022.scr.exe
"C:\Users\Admin\AppData\Local\Temp\05172022.scr.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\componentWebfont\xLuqGiroaa7BzMlNIfHTLkz.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\componentWebfont\IqjWTYaG8BaLm8.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\componentWebfont\Fontreviewnet.exe
      "C:\componentWebfont\Fontreviewnet.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Users\Admin\Saved Games\conhost.exe
        
        "C:\Users\Admin\Saved Games\conhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\componentWebfont\file.vbs"
  2⤵
  PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Saved Games\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Videos\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Admin\Videos\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Videos\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

conhost.exe

Path C:\Users\Admin\Saved Games\conhost.exe
Size 1.5MB
SHA256 1f9b28083379d3ccc094f431b4d866717f29ca6be3d400c42ab359033db4e9c0
MD5 9abc2f13e5cd2a7e1fe4e0d4b02a4d80
SHA1 c540fc9d832d7323e2cffdf1a5aefde1f3bf41e6
SHA512 09477b82a7c9021513725bcbcf67038d515395715f66712e1432f446759ea619d749b29cb7b20816ec97c9ceebfd8d658590a340712ec6ac0d939c9fc888e14c
SSDEEP 24576:vtyv8A98fswetMERl6ee3tEBSknljPMYeXjp/s8H0mEiIE/R:IkA9we5dmEs2lArjlLEy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Users\Admin\Saved Games\conhost.exe
Size 1.5MB
SHA256 1f9b28083379d3ccc094f431b4d866717f29ca6be3d400c42ab359033db4e9c0
MD5 9abc2f13e5cd2a7e1fe4e0d4b02a4d80
SHA1 c540fc9d832d7323e2cffdf1a5aefde1f3bf41e6
SHA512 09477b82a7c9021513725bcbcf67038d515395715f66712e1432f446759ea619d749b29cb7b20816ec97c9ceebfd8d658590a340712ec6ac0d939c9fc888e14c
SSDEEP 24576:vtyv8A98fswetMERl6ee3tEBSknljPMYeXjp/s8H0mEiIE/R:IkA9we5dmEs2lArjlLEy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fontreviewnet.exe

Path C:\componentWebfont\Fontreviewnet.exe
Size 1.5MB
SHA256 1f9b28083379d3ccc094f431b4d866717f29ca6be3d400c42ab359033db4e9c0
MD5 9abc2f13e5cd2a7e1fe4e0d4b02a4d80
SHA1 c540fc9d832d7323e2cffdf1a5aefde1f3bf41e6
SHA512 09477b82a7c9021513725bcbcf67038d515395715f66712e1432f446759ea619d749b29cb7b20816ec97c9ceebfd8d658590a340712ec6ac0d939c9fc888e14c
SSDEEP 24576:vtyv8A98fswetMERl6ee3tEBSknljPMYeXjp/s8H0mEiIE/R:IkA9we5dmEs2lArjlLEy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fontreviewnet.exe

Path C:\componentWebfont\Fontreviewnet.exe
Size 1.5MB
SHA256 1f9b28083379d3ccc094f431b4d866717f29ca6be3d400c42ab359033db4e9c0
MD5 9abc2f13e5cd2a7e1fe4e0d4b02a4d80
SHA1 c540fc9d832d7323e2cffdf1a5aefde1f3bf41e6
SHA512 09477b82a7c9021513725bcbcf67038d515395715f66712e1432f446759ea619d749b29cb7b20816ec97c9ceebfd8d658590a340712ec6ac0d939c9fc888e14c
SSDEEP 24576:vtyv8A98fswetMERl6ee3tEBSknljPMYeXjp/s8H0mEiIE/R:IkA9we5dmEs2lArjlLEy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

IqjWTYaG8BaLm8.bat

Path C:\componentWebfont\IqjWTYaG8BaLm8.bat
Size 39B
SHA256 20339cff524d4ac8c86c5f6e74a6a9b67e273160f5007641ce03b723be40c908
MD5 55b1f1bd63cc5520f136cb8e51728ac6
SHA1 74890731239b7166d40dc224a79e42930e4bac34
SHA512 dcd3ad43c43e6418448c7a21b2c6c44d798b460660be240071301b4d1bc257fb114c5539ca6acfafa71b50d9b0706fb7dd5d31a6f47879bb249e1f432f631e01
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\componentWebfont\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

xLuqGiroaa7BzMlNIfHTLkz.vbe

Path C:\componentWebfont\xLuqGiroaa7BzMlNIfHTLkz.vbe
Size 207B
SHA256 066bf7d19d36c6ff895c799f606c37b38bd42ba68483c83c4fac57708d06d3a2
MD5 83a724e2a70410ea6d684ee7ff3bb012
SHA1 75a9441ef70ff13990b71e95767170f472e758e4
SHA512 476e0c345597822db3f0a48648422b0ac11f155c3ec2e71a6f60909369afb19be3571f341926f9dd9259d635865ffbaa246710ad1690e84a5e9e66369ea804b7
MD5 SHA1 SHA512

Submit Download

memory/228-139-0x0000000000D70000-0x0000000000EEE000-memory.dmp

Download

memory/228-140-0x000000001D650000-0x000000001D6A0000-memory.dmp

Download

memory/228-141-0x000000001DEC0000-0x000000001E3E8000-memory.dmp

Download

memory/228-142-0x00007FFC4A970000-0x00007FFC4B431000-memory.dmp

Download

memory/5040-146-0x00007FFC4A970000-0x00007FFC4B431000-memory.dmp

Download