Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
26/01/2023, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
SetupApp_v6.7.1/SetupApp_v6.7.1.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
- Target SetupApp_v6.7.1/SetupApp_v6.7.1.exe
- Size 642.0MB
- Sample230126-t3xe3aed59
- SHA256 4da47bbacd63b87770ba54c66d404906faec73a9f421342eb91c19408306e456
- MD5 f21f9ca90199c531a8ed2ecdc4538f04
- SHA1 60c48fdd76d8ec0c0b519f4f581a98bca9839e18
- SHA512 81f937ea5106d7310d37972efb9eb1f4a13e2adc5802a47444d2b0777643ef3dcaa08c28fd1e46bcf2fbde3994a35b5c8c78df4c8a8296b4bdf22ced2c322aa1
- SSDEEP 12288:QpWW9NRm4HmsdutOR1S688a2iPk4bFpDbp2O2l3egeH9mvYYOJa7BNBI0HzKN37a:A99hrR1GN1q
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
aurora
C2
-
45.15.156.219:8081
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 14 1404 powershell.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
pid Process 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1404 set thread context of 1336 1404 powershell.exe 93 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1404 powershell.exe Token: SeIncreaseQuotaPrivilege 4480 wmic.exe Token: SeSecurityPrivilege 4480 wmic.exe Token: SeTakeOwnershipPrivilege 4480 wmic.exe Token: SeLoadDriverPrivilege 4480 wmic.exe Token: SeSystemProfilePrivilege 4480 wmic.exe Token: SeSystemtimePrivilege 4480 wmic.exe Token: SeProfSingleProcessPrivilege 4480 wmic.exe Token: SeIncBasePriorityPrivilege 4480 wmic.exe Token: SeCreatePagefilePrivilege 4480 wmic.exe Token: SeBackupPrivilege 4480 wmic.exe Token: SeRestorePrivilege 4480 wmic.exe Token: SeShutdownPrivilege 4480 wmic.exe Token: SeDebugPrivilege 4480 wmic.exe Token: SeSystemEnvironmentPrivilege 4480 wmic.exe Token: SeRemoteShutdownPrivilege 4480 wmic.exe Token: SeUndockPrivilege 4480 wmic.exe Token: SeManageVolumePrivilege 4480 wmic.exe Token: 33 4480 wmic.exe Token: 34 4480 wmic.exe Token: 35 4480 wmic.exe Token: 36 4480 wmic.exe Token: SeIncreaseQuotaPrivilege 4480 wmic.exe Token: SeSecurityPrivilege 4480 wmic.exe Token: SeTakeOwnershipPrivilege 4480 wmic.exe Token: SeLoadDriverPrivilege 4480 wmic.exe Token: SeSystemProfilePrivilege 4480 wmic.exe Token: SeSystemtimePrivilege 4480 wmic.exe Token: SeProfSingleProcessPrivilege 4480 wmic.exe Token: SeIncBasePriorityPrivilege 4480 wmic.exe Token: SeCreatePagefilePrivilege 4480 wmic.exe Token: SeBackupPrivilege 4480 wmic.exe Token: SeRestorePrivilege 4480 wmic.exe Token: SeShutdownPrivilege 4480 wmic.exe Token: SeDebugPrivilege 4480 wmic.exe Token: SeSystemEnvironmentPrivilege 4480 wmic.exe Token: SeRemoteShutdownPrivilege 4480 wmic.exe Token: SeUndockPrivilege 4480 wmic.exe Token: SeManageVolumePrivilege 4480 wmic.exe Token: 33 4480 wmic.exe Token: 34 4480 wmic.exe Token: 35 4480 wmic.exe Token: 36 4480 wmic.exe Token: SeIncreaseQuotaPrivilege 4656 WMIC.exe Token: SeSecurityPrivilege 4656 WMIC.exe Token: SeTakeOwnershipPrivilege 4656 WMIC.exe Token: SeLoadDriverPrivilege 4656 WMIC.exe Token: SeSystemProfilePrivilege 4656 WMIC.exe Token: SeSystemtimePrivilege 4656 WMIC.exe Token: SeProfSingleProcessPrivilege 4656 WMIC.exe Token: SeIncBasePriorityPrivilege 4656 WMIC.exe Token: SeCreatePagefilePrivilege 4656 WMIC.exe Token: SeBackupPrivilege 4656 WMIC.exe Token: SeRestorePrivilege 4656 WMIC.exe Token: SeShutdownPrivilege 4656 WMIC.exe Token: SeDebugPrivilege 4656 WMIC.exe Token: SeSystemEnvironmentPrivilege 4656 WMIC.exe Token: SeRemoteShutdownPrivilege 4656 WMIC.exe Token: SeUndockPrivilege 4656 WMIC.exe Token: SeManageVolumePrivilege 4656 WMIC.exe Token: 33 4656 WMIC.exe Token: 34 4656 WMIC.exe Token: 35 4656 WMIC.exe Token: 36 4656 WMIC.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1460 WORDPAD.EXE 1460 WORDPAD.EXE 1460 WORDPAD.EXE 1460 WORDPAD.EXE 1460 WORDPAD.EXE - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4772 wrote to memory of 1404 4772 SetupApp_v6.7.1.exe 82 PID 4772 wrote to memory of 1404 4772 SetupApp_v6.7.1.exe 82 PID 4772 wrote to memory of 1404 4772 SetupApp_v6.7.1.exe 82 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1404 wrote to memory of 1336 1404 powershell.exe 93 PID 1336 wrote to memory of 4480 1336 aspnet_compiler.exe 94 PID 1336 wrote to memory of 4480 1336 aspnet_compiler.exe 94 PID 1336 wrote to memory of 4480 1336 aspnet_compiler.exe 94 PID 1336 wrote to memory of 1092 1336 aspnet_compiler.exe 96 PID 1336 wrote to memory of 1092 1336 aspnet_compiler.exe 96 PID 1336 wrote to memory of 1092 1336 aspnet_compiler.exe 96 PID 1092 wrote to memory of 4656 1092 cmd.exe 98 PID 1092 wrote to memory of 4656 1092 cmd.exe 98 PID 1092 wrote to memory of 4656 1092 cmd.exe 98 PID 1336 wrote to memory of 4144 1336 aspnet_compiler.exe 99 PID 1336 wrote to memory of 4144 1336 aspnet_compiler.exe 99 PID 1336 wrote to memory of 4144 1336 aspnet_compiler.exe 99 PID 4144 wrote to memory of 4784 4144 cmd.exe 101 PID 4144 wrote to memory of 4784 4144 cmd.exe 101 PID 4144 wrote to memory of 4784 4144 cmd.exe 101 PID 1312 wrote to memory of 1460 1312 MSOXMLED.EXE 106 PID 1312 wrote to memory of 1460 1312 MSOXMLED.EXE 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\SetupApp_v6.7.1\SetupApp_v6.7.1.exe"C:\Users\Admin\AppData\Local\Temp\SetupApp_v6.7.1\SetupApp_v6.7.1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"4⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"4⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name5⤵PID:4784
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1640
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb edit "C:\Users\Admin\AppData\Local\Temp\SetupApp_v6.7.1\Lib\apogee\warmusVeiners\gyrosynRivellExtruct.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\AppData\Local\Temp\SetupApp_v6.7.1\Lib\apogee\warmusVeiners\gyrosynRivellExtruct.xml"2⤵
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:468