Analysis
- max time kernel
138s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
30/12/2022, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
SetupMain.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
SetupMain.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target SetupMain.exe
- Size 10.0MB
- Sample221230-fmzzcsac5w
- SHA256 2e25487afa59800e53d9116f10d01ffda44326f446966fda4b6d667ee90d4c4f
- MD5 720296d00845e149a57a103201f09e2a
- SHA1 edf79f7aca5adb29404db3ae2afbe0fbbbee8eef
- SHA512 787b56281a6c23219da2db25ede4f90e0836508d92d20dc0bd6b14a66a9feedba38ce62bec119c9ca76001c5548e3f4153211e681f4ee05a8c134c1f85961324
- SSDEEP 196608:3K48YbtSvdrmS+0EDHqJA6tisNJjZiODHc:3KcbtSvdr1qH0pt3NJViUHc
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 19 2280 powershell.exe - Downloads MZ/PE file
- Loads dropped DLL 3 IoCs
pid Process 3528 aspnet_compiler.exe 3528 aspnet_compiler.exe 3528 aspnet_compiler.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs
pid Process 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2280 set thread context of 3528 2280 powershell.exe 89 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2280 powershell.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3196 wrote to memory of 2280 3196 SetupMain.exe 79 PID 3196 wrote to memory of 2280 3196 SetupMain.exe 79 PID 3196 wrote to memory of 2280 3196 SetupMain.exe 79 PID 2280 wrote to memory of 3528 2280 powershell.exe 89 PID 2280 wrote to memory of 3528 2280 powershell.exe 89 PID 2280 wrote to memory of 3528 2280 powershell.exe 89 PID 2280 wrote to memory of 3528 2280 powershell.exe 89 PID 2280 wrote to memory of 3528 2280 powershell.exe 89 PID 2280 wrote to memory of 3528 2280 powershell.exe 89 PID 2280 wrote to memory of 3528 2280 powershell.exe 89 PID 2280 wrote to memory of 3528 2280 powershell.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\SetupMain.exe"C:\Users\Admin\AppData\Local\Temp\SetupMain.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵
- Loads dropped DLL
PID:3528
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\mozglue.dll
- Size 612KB
- SHA256 4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
- MD5 f07d9977430e762b563eaadc2b94bbfa
- SHA1 da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
- SHA512 6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
- SSDEEP 12288:dfsiG5KNZea77VUHQqROmbIDm0ICRfCtbtEE/2OH9E2ARlZYSd:df53NZea3V+QqROmum0nRKx79E2ARlrd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\nss3.dll
- Size 1.9MB
- SHA256 c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
- MD5 f67d08e8c02574cbc2f1122c53bfb976
- SHA1 6522992957e7e4d074947cad63189f308a80fcf2
- SHA512 2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
- SSDEEP 49152:6dvFywfzFAF7fg39IwA49Kap9bGt+qoStYnOsbqbeQom7gN7BpDD5SkIN1g5D92+:pptximYfpx8OwNiVG09
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\sqlite3.dll
- Size 1.0MB
- SHA256 47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
- MD5 dbf4f8dcefb8056dc6bae4b67ff810ce
- SHA1 bbac1dd8a07c6069415c04b62747d794736d0689
- SHA512 b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
- SSDEEP 24576:9jxwSkSteuT4P/y7HjsXAGJyGvN5z4Rui2IXLbO:9Vww8HyrjsvyWN54RZH+
- MD5 SHA1 SHA512 SSDEEP