9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f

Analysis

max time kernel
175s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25/06/2022, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe
Size 4.1MB
Sample220625-lr2lmsfcgr
SHA256 9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f
MD5 35d4ca4c94e6981a8db8dd5c08f29efe
SHA1 6d4f3098b25350b8c1ad4f5af1dd67db4da96cad
SHA512 6bdb99069e3262a1d5a4158557e3711a44827957fdbc65e078c348a45531e46fb322cd338313de9264e7c24e54cedb11a2b0682b7ccea8da18a7d1754de3ceb7
MD5 SHA1 SHA512

Score

9^/10

discovery evasion spyware stealer

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Download.exe

Blocklisted process makes network request 7 IoCs

flow	pid	Process
10	4548	CScript.exe
12	4548	CScript.exe
37	4548	CScript.exe
51	4548	CScript.exe
63	4548	CScript.exe
69	4548	CScript.exe
70	4548	CScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1916	Download.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Download.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Download.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Wine	Download.exe

Loads dropped DLL 2 IoCs

pid	Process
3712	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe
3712	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
82	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1916	Download.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Doper\DowloadX.exe	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe
File created	C:\Program Files (x86)\Doper\Download.exe	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe
File created	C:\Program Files (x86)\Doper\ipras.vbs	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Download.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Download.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1916	Download.exe
1916	Download.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1916	Download.exe
1916	Download.exe
1916	Download.exe
1916	Download.exe
1916	Download.exe
1916	Download.exe
1916	Download.exe
1916	Download.exe
1916	Download.exe
1916	Download.exe
1916	Download.exe
1916	Download.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 4548	3712	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe	81
PID 3712 wrote to memory of 4548	3712	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe	81
PID 3712 wrote to memory of 4548	3712	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe	81
PID 3712 wrote to memory of 1916	3712	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe	92
PID 3712 wrote to memory of 1916	3712	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe	92
PID 3712 wrote to memory of 1916	3712	9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe	92

C:\Users\Admin\AppData\Local\Temp\9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe
"C:\Users\Admin\AppData\Local\Temp\9c7d04fee8c7077cc7024f345246545fb09a9afc3c88cdb9e90ca51a1451dd6f.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\SysWOW64\CScript.exe
  "C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\Doper\ipras.vbs" //e:vbscript //B //NOLOGO
  2⤵
  - Blocklisted process makes network request
  PID:4548
- C:\Program Files (x86)\Doper\Download.exe
  "C:\Program Files (x86)\Doper\Download.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Download.exe

Path C:\Program Files (x86)\Doper\Download.exe
Size 2.1MB
SHA256 92c05d8cd71dc2e9207ece7179c3a5a8bc81f7d5e7a207374b9a22510944f1f7
MD5 13920945f1e40a72b9a6bec797b3b0ba
SHA1 7548aec5f7335482c7da91b6746db9a07f0beafc
SHA512 f0c6c9590d2003b49ff371946d0bcefd9ad2e420ccb6c7eb960748c9a1e415976ba77cea5bb86ea047ecd241e7557da669cd80e1b1589a4e3c52f74aa198e90c
SSDEEP 49152:qKkLwIYSnDcRpTACudx4X+BbB+ryIElIeDe/:qKkeSnfQX+H+dElIeDe/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download.exe

Path C:\Program Files (x86)\Doper\Download.exe
Size 2.1MB
SHA256 92c05d8cd71dc2e9207ece7179c3a5a8bc81f7d5e7a207374b9a22510944f1f7
MD5 13920945f1e40a72b9a6bec797b3b0ba
SHA1 7548aec5f7335482c7da91b6746db9a07f0beafc
SHA512 f0c6c9590d2003b49ff371946d0bcefd9ad2e420ccb6c7eb960748c9a1e415976ba77cea5bb86ea047ecd241e7557da669cd80e1b1589a4e3c52f74aa198e90c
SSDEEP 49152:qKkLwIYSnDcRpTACudx4X+BbB+ryIElIeDe/:qKkeSnfQX+H+dElIeDe/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ipras.vbs

Path C:\Program Files (x86)\Doper\ipras.vbs
Size 126B
SHA256 a1b0cb16fb2ecd66fccf156024404801ad694056e8a596326c1b27b57d8eabe8
MD5 b802ff9244875f69db2fae0f78e92b10
SHA1 49385a89cd575894a29fbda969b99cc1f5cf8076
SHA512 609856415a7ae2b3e260f945f1c8a8d2a28884c202d37181bea948708918f24b42ae03f17dba1520fddc91b2f7a182b0b8f885f33ea6f81bb3ee4c72e4e9350e
MD5 SHA1 SHA512

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyF7C3.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyF7C3.tmp\nsExec.dll
Size 6KB
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1916-137-0x0000000000B90000-0x00000000010A6000-memory.dmp

Download

memory/1916-138-0x0000000077980000-0x0000000077B23000-memory.dmp

Download

memory/1916-139-0x0000000000B90000-0x00000000010A6000-memory.dmp

Download

memory/1916-140-0x0000000000B90000-0x00000000010A6000-memory.dmp

Download

memory/1916-141-0x0000000077980000-0x0000000077B23000-memory.dmp

Download

memory/1916-142-0x0000000000B90000-0x00000000010A6000-memory.dmp

Download