Analysis

  • max time kernel
    112s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2023 20:13

General

  • Target

    newsoftware-tester.exe

  • Size

    6KB

  • MD5

    d785e46b0d269b0578dcfd1b90375a6a

  • SHA1

    d1c4a196f24f0659c29fb05e99e690c87bf6d673

  • SHA256

    164df1aecac769eb2d9485abcb776f9ee55fc1e297c5b8b2bc50009e786d41b2

  • SHA512

    ea93bf91f0035a2996f227e04ccca718a9a470ca477e2e5af12a5180c70c62d6efcdbfd29d40e0458baa5ebdd525b5281e342ec29d01fc6fc9173a5b625704c3

  • SSDEEP

    96:673zsN+JBcMAiLt6NkIJmaI8RP4e/kvHxNezNt:oo+MOLtErRJcvb4

Malware Config

Extracted

Family

purecrypter

C2

http://justnormalsite.ddns.net/SystemEnv/uploads/newsoftware-tester_Ilbiekxz.png

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\newsoftware-tester.exe
    "C:\Users\Admin\AppData\Local\Temp\newsoftware-tester.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig/release
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /release
        3⤵
        • Gathers network information
        PID:1080
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1424
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4400
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1804
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig/renew
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /renew
        3⤵
        • Gathers network information
        PID:1384
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4192
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4720
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
            PID:3512
          • C:\Windows\SysWOW64\netsh.exe
            netsh wlan show profile
            4⤵
              PID:4832
            • C:\Windows\SysWOW64\findstr.exe
              findstr All
              4⤵
                PID:1580
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:408
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                4⤵
                  PID:4688
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show profile name="65001" key=clear
                  4⤵
                    PID:4804
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr Key
                    4⤵
                      PID:3928
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1900
                    3⤵
                    • Program crash
                    PID:4140
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 4192
                1⤵
                  PID:3520

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Execution

                Command-Line Interface

                1
                T1059

                Credential Access

                Credentials in Files

                1
                T1081

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                4
                T1082

                Collection

                Data from Local System

                1
                T1005

                Email Collection

                1
                T1114

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                  Filesize

                  1KB

                  MD5

                  4280e36a29fa31c01e4d8b2ba726a0d8

                  SHA1

                  c485c2c9ce0a99747b18d899b71dfa9a64dabe32

                  SHA256

                  e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

                  SHA512

                  494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                  Filesize

                  53KB

                  MD5

                  06ad34f9739c5159b4d92d702545bd49

                  SHA1

                  9152a0d4f153f3f40f7e606be75f81b582ee0c17

                  SHA256

                  474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

                  SHA512

                  c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  16KB

                  MD5

                  c3580172364b06cd03b6d7eda70dd42f

                  SHA1

                  c473e14f1ac3cfefa57f24a9f61be0b82bf9625e

                  SHA256

                  da8c0b77e5fa1f121d0d8efc4fd6d95cd0a0d531aadbe3790682ac1d835ec241

                  SHA512

                  9efd6241ecba87e28ef350719d6ad307893f45c2ea8bd8e31b5cb4e47b485b36496c050a1ba2c94c643a7da65694a8e69222f4c1a13fabc28920f2bc3224a579

                • memory/408-169-0x0000000000000000-mapping.dmp
                • memory/1080-135-0x0000000000000000-mapping.dmp
                • memory/1384-147-0x0000000000000000-mapping.dmp
                • memory/1424-142-0x0000000007A90000-0x000000000810A000-memory.dmp
                  Filesize

                  6MB

                • memory/1424-137-0x0000000002E50000-0x0000000002E86000-memory.dmp
                  Filesize

                  216KB

                • memory/1424-140-0x0000000005E40000-0x0000000005EA6000-memory.dmp
                  Filesize

                  408KB

                • memory/1424-141-0x0000000006450000-0x000000000646E000-memory.dmp
                  Filesize

                  120KB

                • memory/1424-143-0x0000000006940000-0x000000000695A000-memory.dmp
                  Filesize

                  104KB

                • memory/1424-139-0x0000000005710000-0x0000000005776000-memory.dmp
                  Filesize

                  408KB

                • memory/1424-138-0x00000000057A0000-0x0000000005DC8000-memory.dmp
                  Filesize

                  6MB

                • memory/1424-136-0x0000000000000000-mapping.dmp
                • memory/1520-134-0x0000000000000000-mapping.dmp
                • memory/1580-168-0x0000000000000000-mapping.dmp
                • memory/1804-154-0x00000000076B0000-0x00000000076E2000-memory.dmp
                  Filesize

                  200KB

                • memory/1804-161-0x0000000007C60000-0x0000000007C68000-memory.dmp
                  Filesize

                  32KB

                • memory/1804-160-0x0000000007C80000-0x0000000007C9A000-memory.dmp
                  Filesize

                  104KB

                • memory/1804-159-0x0000000006580000-0x000000000658E000-memory.dmp
                  Filesize

                  56KB

                • memory/1804-146-0x0000000000000000-mapping.dmp
                • memory/1804-158-0x0000000007D00000-0x0000000007D96000-memory.dmp
                  Filesize

                  600KB

                • memory/1804-155-0x0000000070310000-0x000000007035C000-memory.dmp
                  Filesize

                  304KB

                • memory/1804-157-0x0000000007AC0000-0x0000000007ACA000-memory.dmp
                  Filesize

                  40KB

                • memory/1804-156-0x0000000007690000-0x00000000076AE000-memory.dmp
                  Filesize

                  120KB

                • memory/3512-166-0x0000000000000000-mapping.dmp
                • memory/3928-172-0x0000000000000000-mapping.dmp
                • memory/4192-149-0x0000000000000000-mapping.dmp
                • memory/4192-151-0x00000000059B0000-0x0000000005F54000-memory.dmp
                  Filesize

                  5MB

                • memory/4192-150-0x0000000000400000-0x000000000045A000-memory.dmp
                  Filesize

                  360KB

                • memory/4192-165-0x0000000006E50000-0x0000000006EEC000-memory.dmp
                  Filesize

                  624KB

                • memory/4192-162-0x0000000006280000-0x0000000006312000-memory.dmp
                  Filesize

                  584KB

                • memory/4192-164-0x0000000006C60000-0x0000000006CB0000-memory.dmp
                  Filesize

                  320KB

                • memory/4400-144-0x0000000000000000-mapping.dmp
                • memory/4688-170-0x0000000000000000-mapping.dmp
                • memory/4708-132-0x0000000000480000-0x0000000000488000-memory.dmp
                  Filesize

                  32KB

                • memory/4708-133-0x0000000006620000-0x0000000006642000-memory.dmp
                  Filesize

                  136KB

                • memory/4720-163-0x0000000000000000-mapping.dmp
                • memory/4804-171-0x0000000000000000-mapping.dmp
                • memory/4832-167-0x0000000000000000-mapping.dmp
                • memory/4996-145-0x0000000000000000-mapping.dmp