Analysis

  • max time kernel
    106s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2023, 14:57

General

  • Target

    install_windows.exe

  • Size

    268.4MB

  • MD5

    e2cddd280ca697fca70460164de219ca

  • SHA1

    c660af70e77c6b4e1f1024c1e5fb8f240edb52c4

  • SHA256

    44fbfac03f6b951c71960c0e3df9770fe0b17dd4405da33102b2eafd5a566e46

  • SHA512

    6bbfff5dd1d88f65778439bf9e5f28e29bd528fbba501e31191085dae8231b197909514f1e07e88b98d5396c844366f428a7f25e4e4fdebb5a897bd17ca08d11

  • SSDEEP

    49152:nimxoYQinicQV/uj8NTpGktKDJ3MKtHiVqyylZQa0zeJUnvr02F1jNd:nVxHQinqVWjrKqyMJUHN

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\install_windows.exe
    "C:\Users\Admin\AppData\Local\Temp\install_windows.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2036
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic path win32_VideoController get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic path win32_VideoController get name
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3524
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic cpu get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3572
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic cpu get name
        3⤵
          PID:1748
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell "" "start-process C:\Users\Admin\AppData\Local\Temp\6LRRXdXAUP.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\Users\Admin\AppData\Local\Temp\6LRRXdXAUP.exe
          "C:\Users\Admin\AppData\Local\Temp\6LRRXdXAUP.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:5108

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\6LRRXdXAUP.exe

      Filesize

      3.5MB

      MD5

      9234d32cf8a0a0d2e510f10e41788965

      SHA1

      1214d32602efb4a7531edf8a4c3e4aecaeb344bf

      SHA256

      9d51f6c4221624b269d1e94e2df70e77c1f16e701d03cc6e117a60652a98ec8b

      SHA512

      6bb264edba74438c54b34a50c959ed19bc5d960b18f7b0fb2b3e4cd759810f377fea6952d3662554dcbd03206bb0ae45fdf275a9390c446706b3374d124563b1

    • C:\Users\Admin\AppData\Local\Temp\6LRRXdXAUP.exe

      Filesize

      3.5MB

      MD5

      9234d32cf8a0a0d2e510f10e41788965

      SHA1

      1214d32602efb4a7531edf8a4c3e4aecaeb344bf

      SHA256

      9d51f6c4221624b269d1e94e2df70e77c1f16e701d03cc6e117a60652a98ec8b

      SHA512

      6bb264edba74438c54b34a50c959ed19bc5d960b18f7b0fb2b3e4cd759810f377fea6952d3662554dcbd03206bb0ae45fdf275a9390c446706b3374d124563b1

    • memory/3616-142-0x0000000005AD0000-0x0000000005B36000-memory.dmp

      Filesize

      408KB

    • memory/3616-140-0x00000000051B0000-0x00000000051D2000-memory.dmp

      Filesize

      136KB

    • memory/3616-141-0x00000000059B0000-0x0000000005A16000-memory.dmp

      Filesize

      408KB

    • memory/3616-139-0x0000000005280000-0x00000000058A8000-memory.dmp

      Filesize

      6.2MB

    • memory/3616-143-0x0000000006190000-0x00000000061AE000-memory.dmp

      Filesize

      120KB

    • memory/3616-144-0x0000000007370000-0x0000000007406000-memory.dmp

      Filesize

      600KB

    • memory/3616-145-0x0000000006660000-0x000000000667A000-memory.dmp

      Filesize

      104KB

    • memory/3616-146-0x00000000066B0000-0x00000000066D2000-memory.dmp

      Filesize

      136KB

    • memory/3616-147-0x00000000079C0000-0x0000000007F64000-memory.dmp

      Filesize

      5.6MB

    • memory/3616-138-0x0000000004C10000-0x0000000004C46000-memory.dmp

      Filesize

      216KB

    • memory/5108-151-0x0000000000A00000-0x000000000100C000-memory.dmp

      Filesize

      6.0MB