Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-06-2022 20:00
General
-
Target
Setup.exe
-
Size
388.5MB
-
MD5
9c25f4974604a5f756b5b5ba55c13d38
-
SHA1
039be44cb40164a48a3ef22f7b9065505822bb0d
-
SHA256
580f7f0a85ddab4f515ba5d6cf07d05161763bbc46a4ced8e5bc4b0f45ae8a9a
-
SHA512
36778423d84ad133e71cea556a0d9f67a2144c6f5f1fe0c7d6875f22d61b46f3c5c23351d74e2f65867ecc9ed9b65326ad63c510099b4c68967a21673a8847f6
Malware Config
Extracted
recordbreaker
http://45.67.34.152/
http://45.133.216.249/
Signatures
-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
suricata: ET MALWARE Generic .bin download from Dotted Quad
suricata: ET MALWARE Generic .bin download from Dotted Quad
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 7 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gR1nL930.exe"C:\Users\Admin\AppData\Local\Temp\gR1nL930.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "NodeJSEnvironmentUpdateTask" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\NodeDisplay.Container.exe"3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "NodeJSEnvironmentUpdateTask"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /tn "NodeJSEnvironmentUpdateTask" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\hC5zF4xW4pD6iF6a.xml"3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
Filesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
Filesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
Filesize
6.9MB
MD574744fc068f935608dff34ecd0eb1f96
SHA15e629dd17a206424302b9794f981d3e1b3b25695
SHA2568a9d3071e53165637980d076f325c66630a2189b8adcff78cabe17b41d7d87b3
SHA512c750062b6e9fe2c0fba5391b38553edd7cfac145a6ed2cd0a4ec7cd195b64f3fa1049154247d35494515781031ba7ac64bbac4526eedfe2cd7ef73af16d09b42
-
Filesize
6.9MB
MD574744fc068f935608dff34ecd0eb1f96
SHA15e629dd17a206424302b9794f981d3e1b3b25695
SHA2568a9d3071e53165637980d076f325c66630a2189b8adcff78cabe17b41d7d87b3
SHA512c750062b6e9fe2c0fba5391b38553edd7cfac145a6ed2cd0a4ec7cd195b64f3fa1049154247d35494515781031ba7ac64bbac4526eedfe2cd7ef73af16d09b42
-
Filesize
1KB
MD54c2cafeaec704028781b968c832d57c3
SHA181ca48be909e514edb2d754c0db83e369cfaf0d1
SHA2562a65d65369f3afe3bfd9fdb3d75cff88fd3791ac9d525068962c7762155e5e3e
SHA5128d9b4876c5630d679f57eed30a703c45d21b661b9c4b12ec69e032560896edd9b4934e30ca55e30edfc6cbc93b285f85b1c1c3af870be2b05b5433a2773f6506
-
-
-
Filesize
10.7MB
-
Filesize
10.7MB
-
Filesize
10.7MB
-
Filesize
1.6MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
1.6MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
1.6MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
-