Malware Analysis Report

2025-04-13 11:32

Sample ID 220625-b8zs9sbhd3
Target d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd
SHA256 d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd
Tags
cryptbot discovery evasion spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd

Threat Level: Known bad

The file d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd was found to be: Known bad.

Malicious Activity Summary

cryptbot discovery evasion spyware stealer

CryptBot

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Blocklisted process makes network request

Executes dropped EXE

Checks BIOS information in registry

Identifies Wine through registry keys

Reads user/profile data of web browsers

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-06-25 01:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-25 01:49

Reported

2022-06-25 01:54

Platform

win7-20220414-en

Max time kernel

153s

Max time network

197s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe"

Signatures

CryptBot

spyware stealer cryptbot

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Program Files (x86)\Der\Supr\Setup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\CScript.exe N/A
N/A N/A C:\Windows\SysWOW64\CScript.exe N/A
N/A N/A C:\Windows\SysWOW64\CScript.exe N/A
N/A N/A C:\Windows\SysWOW64\CScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Der\Supr\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Program Files (x86)\Der\Supr\Cdx.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Program Files (x86)\Der\Supr\Cdx.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Program Files (x86)\Der\Supr\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Program Files (x86)\Der\Supr\Setup.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Wine C:\Program Files (x86)\Der\Supr\Setup.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Wine C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Der\Supr\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Der\Supr\Cdx.exe C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\enigma_ide.dll C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\enigma_ide64.dll C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\udis.dll C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\Setup.exe C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\Two.vbs C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\Pass.txt C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Der\Supr\Setup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Der\Supr\Setup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Der\Supr\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 1900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 1900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 1900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 1900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 1900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 1900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 1900 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe
PID 1900 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe
PID 1900 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe
PID 1900 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe
PID 1900 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe
PID 1900 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe
PID 1900 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe

"C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe"

C:\Program Files (x86)\Der\Supr\Setup.exe

"C:\Program Files (x86)\Der\Supr\Setup.exe"

C:\Windows\SysWOW64\CScript.exe

"C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\Der\Supr\Two.vbs" //e:vbscript //B //NOLOGO

C:\Program Files (x86)\Der\Supr\Cdx.exe

"C:\Program Files (x86)\Der\Supr\Cdx.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 iplogger.org udp
DE 148.251.234.83:443 iplogger.org tcp
DE 148.251.234.83:443 iplogger.org tcp
DE 148.251.234.83:443 iplogger.org tcp
DE 148.251.234.83:443 iplogger.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 nife04.info udp

Files

memory/1900-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsy92CF.tmp\UAC.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

\Program Files (x86)\Der\Supr\Setup.exe

MD5 85f23b584b90f70c3df7fc98786cef0e
SHA1 f79271242dc8332ea8ac3644367b86a1fdb6604c
SHA256 dcaae466817bfe1a408ce564c702ccc373eff859b6b134f2b8b5b10142e948d8
SHA512 a3d33cedf920e83eb438306821e8243d815c85176c993e6b91fba6c5279c3e0f47f8a868b8f10a80b3f8edf53f6625af566eef22da7a182896ad812e26b58a7d

memory/1324-57-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Der\Supr\Setup.exe

MD5 85f23b584b90f70c3df7fc98786cef0e
SHA1 f79271242dc8332ea8ac3644367b86a1fdb6604c
SHA256 dcaae466817bfe1a408ce564c702ccc373eff859b6b134f2b8b5b10142e948d8
SHA512 a3d33cedf920e83eb438306821e8243d815c85176c993e6b91fba6c5279c3e0f47f8a868b8f10a80b3f8edf53f6625af566eef22da7a182896ad812e26b58a7d

\Users\Admin\AppData\Local\Temp\nsy92CF.tmp\nsExec.dll

MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

\Program Files (x86)\Der\Supr\Setup.exe

MD5 85f23b584b90f70c3df7fc98786cef0e
SHA1 f79271242dc8332ea8ac3644367b86a1fdb6604c
SHA256 dcaae466817bfe1a408ce564c702ccc373eff859b6b134f2b8b5b10142e948d8
SHA512 a3d33cedf920e83eb438306821e8243d815c85176c993e6b91fba6c5279c3e0f47f8a868b8f10a80b3f8edf53f6625af566eef22da7a182896ad812e26b58a7d

\Program Files (x86)\Der\Supr\Setup.exe

MD5 85f23b584b90f70c3df7fc98786cef0e
SHA1 f79271242dc8332ea8ac3644367b86a1fdb6604c
SHA256 dcaae466817bfe1a408ce564c702ccc373eff859b6b134f2b8b5b10142e948d8
SHA512 a3d33cedf920e83eb438306821e8243d815c85176c993e6b91fba6c5279c3e0f47f8a868b8f10a80b3f8edf53f6625af566eef22da7a182896ad812e26b58a7d

C:\Program Files (x86)\Der\Supr\Setup.exe

MD5 85f23b584b90f70c3df7fc98786cef0e
SHA1 f79271242dc8332ea8ac3644367b86a1fdb6604c
SHA256 dcaae466817bfe1a408ce564c702ccc373eff859b6b134f2b8b5b10142e948d8
SHA512 a3d33cedf920e83eb438306821e8243d815c85176c993e6b91fba6c5279c3e0f47f8a868b8f10a80b3f8edf53f6625af566eef22da7a182896ad812e26b58a7d

memory/1748-64-0x0000000000000000-mapping.dmp

memory/1900-65-0x0000000002750000-0x0000000002C92000-memory.dmp

memory/1324-66-0x00000000013E0000-0x0000000001922000-memory.dmp

memory/1324-67-0x0000000000BC0000-0x0000000001102000-memory.dmp

memory/1324-68-0x0000000000BC0000-0x0000000001102000-memory.dmp

C:\Program Files (x86)\Der\Supr\Two.vbs

MD5 c6362e3c5585f24a9e9a2712c00c52ff
SHA1 9259b9609313386f004328d2c306820eae01a587
SHA256 184ca5b2737175e0828f3546d483778c95e23720f1375deac0090c2fe415e208
SHA512 59ac94fdb6f41d6dc5cbea1855897759f35032ac922b936a0b39a21b6aafb0c862c5d419afa31c0b81f106f2ce06b2909cdb5fb713534fbe36202c5a4fedfeaa

memory/1324-71-0x0000000077000000-0x0000000077180000-memory.dmp

memory/1324-72-0x00000000013E0000-0x0000000001922000-memory.dmp

memory/1324-73-0x0000000073801000-0x0000000073803000-memory.dmp

memory/1324-74-0x00000000732A1000-0x00000000732A3000-memory.dmp

memory/1324-82-0x00000000013E0000-0x0000000001922000-memory.dmp

memory/1324-83-0x0000000000BC0000-0x0000000001102000-memory.dmp

memory/1324-84-0x00000000013E0000-0x0000000001922000-memory.dmp

\Program Files (x86)\Der\Supr\Cdx.exe

MD5 4439cc1740e82b9f3fb33530a6e1e8a6
SHA1 48e54edeaa74bef978331bd8462a6574e3d0082e
SHA256 808df2e63220ea5d4f44e14fc2889aaf5fc4cf4ae4a108483d98b8af731a6996
SHA512 2b356b2fe5bd74e6ddaaa26b8e56c1dc0b8b6d96239169c23c4e8648bae8dc786c1ae65278a3a701fc56f5057920ed067c5021b97090935beff1512a7c70324b

memory/1608-86-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Der\Supr\Cdx.exe

MD5 4439cc1740e82b9f3fb33530a6e1e8a6
SHA1 48e54edeaa74bef978331bd8462a6574e3d0082e
SHA256 808df2e63220ea5d4f44e14fc2889aaf5fc4cf4ae4a108483d98b8af731a6996
SHA512 2b356b2fe5bd74e6ddaaa26b8e56c1dc0b8b6d96239169c23c4e8648bae8dc786c1ae65278a3a701fc56f5057920ed067c5021b97090935beff1512a7c70324b

\Program Files (x86)\Der\Supr\Cdx.exe

MD5 4439cc1740e82b9f3fb33530a6e1e8a6
SHA1 48e54edeaa74bef978331bd8462a6574e3d0082e
SHA256 808df2e63220ea5d4f44e14fc2889aaf5fc4cf4ae4a108483d98b8af731a6996
SHA512 2b356b2fe5bd74e6ddaaa26b8e56c1dc0b8b6d96239169c23c4e8648bae8dc786c1ae65278a3a701fc56f5057920ed067c5021b97090935beff1512a7c70324b

\Program Files (x86)\Der\Supr\Cdx.exe

MD5 4439cc1740e82b9f3fb33530a6e1e8a6
SHA1 48e54edeaa74bef978331bd8462a6574e3d0082e
SHA256 808df2e63220ea5d4f44e14fc2889aaf5fc4cf4ae4a108483d98b8af731a6996
SHA512 2b356b2fe5bd74e6ddaaa26b8e56c1dc0b8b6d96239169c23c4e8648bae8dc786c1ae65278a3a701fc56f5057920ed067c5021b97090935beff1512a7c70324b

C:\Program Files (x86)\Der\Supr\Cdx.exe

MD5 4439cc1740e82b9f3fb33530a6e1e8a6
SHA1 48e54edeaa74bef978331bd8462a6574e3d0082e
SHA256 808df2e63220ea5d4f44e14fc2889aaf5fc4cf4ae4a108483d98b8af731a6996
SHA512 2b356b2fe5bd74e6ddaaa26b8e56c1dc0b8b6d96239169c23c4e8648bae8dc786c1ae65278a3a701fc56f5057920ed067c5021b97090935beff1512a7c70324b

memory/1900-92-0x00000000027D0000-0x0000000002CEA000-memory.dmp

memory/1608-93-0x0000000000400000-0x000000000091A000-memory.dmp

memory/1608-94-0x0000000001340000-0x000000000185A000-memory.dmp

memory/1608-95-0x0000000001340000-0x000000000185A000-memory.dmp

memory/1608-96-0x0000000077000000-0x0000000077180000-memory.dmp

memory/1900-97-0x00000000027D0000-0x0000000002CEA000-memory.dmp

memory/1608-98-0x0000000000400000-0x000000000091A000-memory.dmp

memory/1608-99-0x0000000001340000-0x000000000185A000-memory.dmp

memory/1608-100-0x0000000077000000-0x0000000077180000-memory.dmp

memory/1608-101-0x0000000000400000-0x000000000091A000-memory.dmp

memory/1608-103-0x0000000000400000-0x000000000091A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-25 01:49

Reported

2022-06-25 01:52

Platform

win10v2004-20220414-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe"

Signatures

CryptBot

spyware stealer cryptbot

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Program Files (x86)\Der\Supr\Setup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\CScript.exe N/A
N/A N/A C:\Windows\SysWOW64\CScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Der\Supr\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Program Files (x86)\Der\Supr\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Program Files (x86)\Der\Supr\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Program Files (x86)\Der\Supr\Cdx.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Wine C:\Program Files (x86)\Der\Supr\Setup.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Wine C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Der\Supr\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Der\Supr\udis.dll C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\Setup.exe C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\Two.vbs C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\Pass.txt C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\Cdx.exe C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\enigma_ide.dll C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A
File created C:\Program Files (x86)\Der\Supr\enigma_ide64.dll C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Der\Supr\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Der\Supr\Setup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Der\Supr\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Der\Supr\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Der\Supr\Cdx.exe N/A
N/A N/A C:\Program Files (x86)\Der\Supr\Cdx.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2204 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 2204 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 2204 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Setup.exe
PID 2204 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 2204 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 2204 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Windows\SysWOW64\CScript.exe
PID 2204 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe
PID 2204 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe
PID 2204 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe C:\Program Files (x86)\Der\Supr\Cdx.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe

"C:\Users\Admin\AppData\Local\Temp\d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd.exe"

C:\Program Files (x86)\Der\Supr\Setup.exe

"C:\Program Files (x86)\Der\Supr\Setup.exe"

C:\Windows\SysWOW64\CScript.exe

"C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\Der\Supr\Two.vbs" //e:vbscript //B //NOLOGO

C:\Program Files (x86)\Der\Supr\Cdx.exe

"C:\Program Files (x86)\Der\Supr\Cdx.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 iplogger.org udp
DE 148.251.234.83:443 iplogger.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 20.44.10.122:443 tcp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
NL 8.248.7.254:80 tcp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
NL 8.248.7.254:80 tcp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 jload04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp
US 8.8.8.8:53 nife04.info udp

Files

C:\Users\Admin\AppData\Local\Temp\nsmA677.tmp\UAC.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

memory/2084-131-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Der\Supr\Setup.exe

MD5 85f23b584b90f70c3df7fc98786cef0e
SHA1 f79271242dc8332ea8ac3644367b86a1fdb6604c
SHA256 dcaae466817bfe1a408ce564c702ccc373eff859b6b134f2b8b5b10142e948d8
SHA512 a3d33cedf920e83eb438306821e8243d815c85176c993e6b91fba6c5279c3e0f47f8a868b8f10a80b3f8edf53f6625af566eef22da7a182896ad812e26b58a7d

C:\Program Files (x86)\Der\Supr\Setup.exe

MD5 85f23b584b90f70c3df7fc98786cef0e
SHA1 f79271242dc8332ea8ac3644367b86a1fdb6604c
SHA256 dcaae466817bfe1a408ce564c702ccc373eff859b6b134f2b8b5b10142e948d8
SHA512 a3d33cedf920e83eb438306821e8243d815c85176c993e6b91fba6c5279c3e0f47f8a868b8f10a80b3f8edf53f6625af566eef22da7a182896ad812e26b58a7d

memory/4088-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\nsmA677.tmp\nsExec.dll

MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

memory/2084-136-0x0000000000800000-0x0000000000D42000-memory.dmp

C:\Program Files (x86)\Der\Supr\Two.vbs

MD5 c6362e3c5585f24a9e9a2712c00c52ff
SHA1 9259b9609313386f004328d2c306820eae01a587
SHA256 184ca5b2737175e0828f3546d483778c95e23720f1375deac0090c2fe415e208
SHA512 59ac94fdb6f41d6dc5cbea1855897759f35032ac922b936a0b39a21b6aafb0c862c5d419afa31c0b81f106f2ce06b2909cdb5fb713534fbe36202c5a4fedfeaa

memory/2084-138-0x00000000777E0000-0x0000000077983000-memory.dmp

memory/2084-139-0x0000000000800000-0x0000000000D42000-memory.dmp

memory/3828-140-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Der\Supr\Cdx.exe

MD5 4439cc1740e82b9f3fb33530a6e1e8a6
SHA1 48e54edeaa74bef978331bd8462a6574e3d0082e
SHA256 808df2e63220ea5d4f44e14fc2889aaf5fc4cf4ae4a108483d98b8af731a6996
SHA512 2b356b2fe5bd74e6ddaaa26b8e56c1dc0b8b6d96239169c23c4e8648bae8dc786c1ae65278a3a701fc56f5057920ed067c5021b97090935beff1512a7c70324b

memory/3828-142-0x0000000000400000-0x000000000091A000-memory.dmp

memory/3828-143-0x00000000777E0000-0x0000000077983000-memory.dmp

memory/3828-144-0x0000000000400000-0x000000000091A000-memory.dmp

memory/2084-145-0x0000000000800000-0x0000000000D42000-memory.dmp

memory/2084-146-0x00000000777E0000-0x0000000077983000-memory.dmp

memory/2084-147-0x0000000000800000-0x0000000000D42000-memory.dmp

memory/3828-148-0x0000000000400000-0x000000000091A000-memory.dmp

memory/3828-149-0x0000000000400000-0x000000000091A000-memory.dmp