Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
22/11/2022, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
- Target file.exe
- Size 2.1MB
- Sample221122-ld6y7sgf86
- SHA256 ddf46263a07e42ae3c237f9745d49df8dc803c4c3b9b423cb335f9fbc21e57cc
- MD5 419182848335b236c9c97539679b4c9e
- SHA1 e891cf98d039ccd3b125e45791f4488bf993f2b4
- SHA512 68bfe14b4020d0921eae7319424dc818f8646927d8bf926592ed69cef112cea7751abccba02c2e24209af500c70348cd4683f8ee2a6d065ef9d2ae51da48f5e7
- SSDEEP 49152:mwm9kQv2FJ6bSs55NuTWhGEPPWn773GJ1paNmhJLRfWLqmAuFIIhGjjjad3:xm+Qv2FJ6Os5dhGEPk72JHLRfsqmxFI6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/380-133-0x0000000001000000-0x00000000015B4000-memory.dmp upx behavioral2/memory/380-138-0x0000000001000000-0x00000000015B4000-memory.dmp upx behavioral2/memory/380-139-0x0000000001000000-0x00000000015B4000-memory.dmp upx behavioral2/memory/380-140-0x0000000001000000-0x00000000015B4000-memory.dmp upx behavioral2/memory/380-141-0x0000000001000000-0x00000000015B4000-memory.dmp upx behavioral2/memory/380-142-0x0000000001000000-0x00000000015B4000-memory.dmp upx behavioral2/memory/380-143-0x0000000001000000-0x00000000015B4000-memory.dmp upx - Uses the VBS compiler for execution 1 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5000 set thread context of 380 5000 file.exe 83 - Program crash 1 IoCs
pid pid_target Process procid_target 2388 5000 WerFault.exe 81 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe 380 vbc.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 380 vbc.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5000 wrote to memory of 380 5000 file.exe 83 PID 5000 wrote to memory of 380 5000 file.exe 83 PID 5000 wrote to memory of 380 5000 file.exe 83 PID 5000 wrote to memory of 380 5000 file.exe 83 PID 5000 wrote to memory of 380 5000 file.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 1402⤵
- Program crash
PID:2388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5000 -ip 50001⤵PID:1536