Analysis
-
max time kernel
112s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2023 20:13
Behavioral task
behavioral1
Sample
newsoftware-tester.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
newsoftware-tester.exe
Resource
win10v2004-20221111-en
General
-
Target
newsoftware-tester.exe
-
Size
6KB
-
MD5
d785e46b0d269b0578dcfd1b90375a6a
-
SHA1
d1c4a196f24f0659c29fb05e99e690c87bf6d673
-
SHA256
164df1aecac769eb2d9485abcb776f9ee55fc1e297c5b8b2bc50009e786d41b2
-
SHA512
ea93bf91f0035a2996f227e04ccca718a9a470ca477e2e5af12a5180c70c62d6efcdbfd29d40e0458baa5ebdd525b5281e342ec29d01fc6fc9173a5b625704c3
-
SSDEEP
96:673zsN+JBcMAiLt6NkIJmaI8RP4e/kvHxNezNt:oo+MOLtErRJcvb4
Malware Config
Extracted
purecrypter
http://justnormalsite.ddns.net/SystemEnv/uploads/newsoftware-tester_Ilbiekxz.png
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
newsoftware-tester.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation newsoftware-tester.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 31 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
newsoftware-tester.exedescription pid process target process PID 4708 set thread context of 4192 4708 newsoftware-tester.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4140 4192 WerFault.exe RegAsm.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier RegAsm.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 1080 ipconfig.exe 1384 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exeRegAsm.exepid process 1424 powershell.exe 1424 powershell.exe 1804 powershell.exe 1804 powershell.exe 4192 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
newsoftware-tester.exepowershell.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 4708 newsoftware-tester.exe Token: SeDebugPrivilege 1424 powershell.exe Token: SeDebugPrivilege 1804 powershell.exe Token: SeDebugPrivilege 4192 RegAsm.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
newsoftware-tester.execmd.execmd.execmd.exeRegAsm.execmd.execmd.exedescription pid process target process PID 4708 wrote to memory of 1520 4708 newsoftware-tester.exe cmd.exe PID 4708 wrote to memory of 1520 4708 newsoftware-tester.exe cmd.exe PID 4708 wrote to memory of 1520 4708 newsoftware-tester.exe cmd.exe PID 1520 wrote to memory of 1080 1520 cmd.exe ipconfig.exe PID 1520 wrote to memory of 1080 1520 cmd.exe ipconfig.exe PID 1520 wrote to memory of 1080 1520 cmd.exe ipconfig.exe PID 4708 wrote to memory of 1424 4708 newsoftware-tester.exe powershell.exe PID 4708 wrote to memory of 1424 4708 newsoftware-tester.exe powershell.exe PID 4708 wrote to memory of 1424 4708 newsoftware-tester.exe powershell.exe PID 4708 wrote to memory of 4400 4708 newsoftware-tester.exe cmd.exe PID 4708 wrote to memory of 4400 4708 newsoftware-tester.exe cmd.exe PID 4708 wrote to memory of 4400 4708 newsoftware-tester.exe cmd.exe PID 4708 wrote to memory of 4996 4708 newsoftware-tester.exe cmd.exe PID 4708 wrote to memory of 4996 4708 newsoftware-tester.exe cmd.exe PID 4708 wrote to memory of 4996 4708 newsoftware-tester.exe cmd.exe PID 4400 wrote to memory of 1804 4400 cmd.exe powershell.exe PID 4400 wrote to memory of 1804 4400 cmd.exe powershell.exe PID 4400 wrote to memory of 1804 4400 cmd.exe powershell.exe PID 4996 wrote to memory of 1384 4996 cmd.exe ipconfig.exe PID 4996 wrote to memory of 1384 4996 cmd.exe ipconfig.exe PID 4996 wrote to memory of 1384 4996 cmd.exe ipconfig.exe PID 4708 wrote to memory of 4192 4708 newsoftware-tester.exe RegAsm.exe PID 4708 wrote to memory of 4192 4708 newsoftware-tester.exe RegAsm.exe PID 4708 wrote to memory of 4192 4708 newsoftware-tester.exe RegAsm.exe PID 4708 wrote to memory of 4192 4708 newsoftware-tester.exe RegAsm.exe PID 4708 wrote to memory of 4192 4708 newsoftware-tester.exe RegAsm.exe PID 4708 wrote to memory of 4192 4708 newsoftware-tester.exe RegAsm.exe PID 4708 wrote to memory of 4192 4708 newsoftware-tester.exe RegAsm.exe PID 4708 wrote to memory of 4192 4708 newsoftware-tester.exe RegAsm.exe PID 4192 wrote to memory of 4720 4192 RegAsm.exe cmd.exe PID 4192 wrote to memory of 4720 4192 RegAsm.exe cmd.exe PID 4192 wrote to memory of 4720 4192 RegAsm.exe cmd.exe PID 4720 wrote to memory of 3512 4720 cmd.exe chcp.com PID 4720 wrote to memory of 3512 4720 cmd.exe chcp.com PID 4720 wrote to memory of 3512 4720 cmd.exe chcp.com PID 4720 wrote to memory of 4832 4720 cmd.exe netsh.exe PID 4720 wrote to memory of 4832 4720 cmd.exe netsh.exe PID 4720 wrote to memory of 4832 4720 cmd.exe netsh.exe PID 4720 wrote to memory of 1580 4720 cmd.exe findstr.exe PID 4720 wrote to memory of 1580 4720 cmd.exe findstr.exe PID 4720 wrote to memory of 1580 4720 cmd.exe findstr.exe PID 4192 wrote to memory of 408 4192 RegAsm.exe cmd.exe PID 4192 wrote to memory of 408 4192 RegAsm.exe cmd.exe PID 4192 wrote to memory of 408 4192 RegAsm.exe cmd.exe PID 408 wrote to memory of 4688 408 cmd.exe chcp.com PID 408 wrote to memory of 4688 408 cmd.exe chcp.com PID 408 wrote to memory of 4688 408 cmd.exe chcp.com PID 408 wrote to memory of 4804 408 cmd.exe netsh.exe PID 408 wrote to memory of 4804 408 cmd.exe netsh.exe PID 408 wrote to memory of 4804 408 cmd.exe netsh.exe PID 408 wrote to memory of 3928 408 cmd.exe findstr.exe PID 408 wrote to memory of 3928 408 cmd.exe findstr.exe PID 408 wrote to memory of 3928 408 cmd.exe findstr.exe -
outlook_office_path 1 IoCs
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
outlook_win_path 1 IoCs
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\newsoftware-tester.exe"C:\Users\Admin\AppData\Local\Temp\newsoftware-tester.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig/release2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig/renew2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile name="65001" key=clear4⤵
-
C:\Windows\SysWOW64\findstr.exefindstr Key4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 19003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 41921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5c3580172364b06cd03b6d7eda70dd42f
SHA1c473e14f1ac3cfefa57f24a9f61be0b82bf9625e
SHA256da8c0b77e5fa1f121d0d8efc4fd6d95cd0a0d531aadbe3790682ac1d835ec241
SHA5129efd6241ecba87e28ef350719d6ad307893f45c2ea8bd8e31b5cb4e47b485b36496c050a1ba2c94c643a7da65694a8e69222f4c1a13fabc28920f2bc3224a579
-
memory/408-169-0x0000000000000000-mapping.dmp
-
memory/1080-135-0x0000000000000000-mapping.dmp
-
memory/1384-147-0x0000000000000000-mapping.dmp
-
memory/1424-142-0x0000000007A90000-0x000000000810A000-memory.dmpFilesize
6MB
-
memory/1424-137-0x0000000002E50000-0x0000000002E86000-memory.dmpFilesize
216KB
-
memory/1424-140-0x0000000005E40000-0x0000000005EA6000-memory.dmpFilesize
408KB
-
memory/1424-141-0x0000000006450000-0x000000000646E000-memory.dmpFilesize
120KB
-
memory/1424-143-0x0000000006940000-0x000000000695A000-memory.dmpFilesize
104KB
-
memory/1424-139-0x0000000005710000-0x0000000005776000-memory.dmpFilesize
408KB
-
memory/1424-138-0x00000000057A0000-0x0000000005DC8000-memory.dmpFilesize
6MB
-
memory/1424-136-0x0000000000000000-mapping.dmp
-
memory/1520-134-0x0000000000000000-mapping.dmp
-
memory/1580-168-0x0000000000000000-mapping.dmp
-
memory/1804-154-0x00000000076B0000-0x00000000076E2000-memory.dmpFilesize
200KB
-
memory/1804-161-0x0000000007C60000-0x0000000007C68000-memory.dmpFilesize
32KB
-
memory/1804-160-0x0000000007C80000-0x0000000007C9A000-memory.dmpFilesize
104KB
-
memory/1804-159-0x0000000006580000-0x000000000658E000-memory.dmpFilesize
56KB
-
memory/1804-146-0x0000000000000000-mapping.dmp
-
memory/1804-158-0x0000000007D00000-0x0000000007D96000-memory.dmpFilesize
600KB
-
memory/1804-155-0x0000000070310000-0x000000007035C000-memory.dmpFilesize
304KB
-
memory/1804-157-0x0000000007AC0000-0x0000000007ACA000-memory.dmpFilesize
40KB
-
memory/1804-156-0x0000000007690000-0x00000000076AE000-memory.dmpFilesize
120KB
-
memory/3512-166-0x0000000000000000-mapping.dmp
-
memory/3928-172-0x0000000000000000-mapping.dmp
-
memory/4192-149-0x0000000000000000-mapping.dmp
-
memory/4192-151-0x00000000059B0000-0x0000000005F54000-memory.dmpFilesize
5MB
-
memory/4192-150-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/4192-165-0x0000000006E50000-0x0000000006EEC000-memory.dmpFilesize
624KB
-
memory/4192-162-0x0000000006280000-0x0000000006312000-memory.dmpFilesize
584KB
-
memory/4192-164-0x0000000006C60000-0x0000000006CB0000-memory.dmpFilesize
320KB
-
memory/4400-144-0x0000000000000000-mapping.dmp
-
memory/4688-170-0x0000000000000000-mapping.dmp
-
memory/4708-132-0x0000000000480000-0x0000000000488000-memory.dmpFilesize
32KB
-
memory/4708-133-0x0000000006620000-0x0000000006642000-memory.dmpFilesize
136KB
-
memory/4720-163-0x0000000000000000-mapping.dmp
-
memory/4804-171-0x0000000000000000-mapping.dmp
-
memory/4832-167-0x0000000000000000-mapping.dmp
-
memory/4996-145-0x0000000000000000-mapping.dmp