Analysis
-
max time kernel
634s -
max time network
648s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
launcher v5.7.1.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral2
Sample
launcher v5.7.1.exe
Resource
win10-20220812-en
windows10-1703-x64
5 signatures
600 seconds
General
-
Target
launcher v5.7.1.exe
-
Size
730.3MB
-
MD5
3608a41ad4e6bb97ac03dde57e1cdbee
-
SHA1
053b82d307d1d37b8edecefeb7db519a4d543261
-
SHA256
040d15a2ef782301ffbcdf4f2a1d7b810a9be14d2f94bdfa3eb65255239ad359
-
SHA512
efc7962c069ff00b6d245d41b5a23557f53bfb8a95e970577d6bf3662ab9de8281524dc70e2fb0a3b2ac7a0f7920b4ed51573e283138dacaba3b7c264a823c6c
-
SSDEEP
98304:TaJFGc5256dZjYLEkV9SeajZwsAq/04ahg6pJ7JRkR5Q:Wn5XnYlfNaahgsJ
Malware Config
Signatures
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe 1992 jsc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1992 jsc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28 PID 1732 wrote to memory of 1992 1732 launcher v5.7.1.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher v5.7.1.exe"C:\Users\Admin\AppData\Local\Temp\launcher v5.7.1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992
-