Analysis

  • max time kernel
    97s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2023, 08:00

General

  • Target

    tmp.exe

  • Size

    2.2MB

  • MD5

    ef691f617d75f45d10af9405de47e253

  • SHA1

    9be134d2c7549adf7c6678bb4c43b9f65c83214f

  • SHA256

    eaead00ba98021393e7920a2f2f20e70724f716eed0933d50577786ae0289182

  • SHA512

    cfe942f09cc75f44aea2eaef80e4dc6a0ebbba020b0c1cefb7efe8e158a6399fb1f5e41d696b932fac542e39ea7b5872fb1adb7c0753670a57fc0f888ee16c61

  • SSDEEP

    24576:qmErCsazef+APWb6+CILRbTcJiWevOIWr9Lrdl5p0WdaMCtGjC+UbuzoVGBI:qPF+CWb6+CILRncZe65rb5p0ehVCrvT

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Local\Temp\XHVNC.exe
      "C:\Users\Admin\AppData\Local\Temp\XHVNC.exe"
      2⤵
      • Executes dropped EXE
      PID:4352
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 1520
        3⤵
        • Program crash
        PID:2076
    • C:\Users\Admin\AppData\Local\Temp\discord.exe
      "C:\Users\Admin\AppData\Local\Temp\discord.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3288
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4352 -ip 4352
    1⤵
      PID:3384

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\XHVNC.exe

            Filesize

            1.9MB

            MD5

            4904329d091687c9deb08d9bd7282e77

            SHA1

            bcf7fcebb52cad605cb4de65bdd077e600475cc7

            SHA256

            e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd

            SHA512

            b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb

          • C:\Users\Admin\AppData\Local\Temp\XHVNC.exe

            Filesize

            1.9MB

            MD5

            4904329d091687c9deb08d9bd7282e77

            SHA1

            bcf7fcebb52cad605cb4de65bdd077e600475cc7

            SHA256

            e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd

            SHA512

            b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb

          • C:\Users\Admin\AppData\Local\Temp\XHVNC.exe

            Filesize

            1.9MB

            MD5

            4904329d091687c9deb08d9bd7282e77

            SHA1

            bcf7fcebb52cad605cb4de65bdd077e600475cc7

            SHA256

            e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd

            SHA512

            b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb

          • C:\Users\Admin\AppData\Local\Temp\discord.exe

            Filesize

            159KB

            MD5

            46a2cc3ad2ade7a6b5551b53636e0abb

            SHA1

            b8eb52479e933c3530ca826fbe59567af3c4f6ec

            SHA256

            f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5

            SHA512

            7649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f

          • C:\Users\Admin\AppData\Local\Temp\discord.exe

            Filesize

            159KB

            MD5

            46a2cc3ad2ade7a6b5551b53636e0abb

            SHA1

            b8eb52479e933c3530ca826fbe59567af3c4f6ec

            SHA256

            f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5

            SHA512

            7649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f

          • C:\Users\Admin\AppData\Local\Temp\discord.exe

            Filesize

            159KB

            MD5

            46a2cc3ad2ade7a6b5551b53636e0abb

            SHA1

            b8eb52479e933c3530ca826fbe59567af3c4f6ec

            SHA256

            f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5

            SHA512

            7649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f

          • memory/1664-155-0x0000000000400000-0x000000000062F000-memory.dmp

            Filesize

            2.2MB

          • memory/3288-160-0x0000000005180000-0x0000000005192000-memory.dmp

            Filesize

            72KB

          • memory/3288-156-0x0000000000910000-0x000000000093E000-memory.dmp

            Filesize

            184KB

          • memory/3288-158-0x00000000057A0000-0x0000000005DB8000-memory.dmp

            Filesize

            6.1MB

          • memory/3288-172-0x0000000007C90000-0x00000000081BC000-memory.dmp

            Filesize

            5.2MB

          • memory/3288-173-0x0000000006EF0000-0x0000000006F40000-memory.dmp

            Filesize

            320KB

          • memory/3288-169-0x0000000006520000-0x0000000006596000-memory.dmp

            Filesize

            472KB

          • memory/3288-171-0x0000000007590000-0x0000000007752000-memory.dmp

            Filesize

            1.8MB

          • memory/3288-162-0x00000000052B0000-0x00000000053BA000-memory.dmp

            Filesize

            1.0MB

          • memory/3288-170-0x0000000006320000-0x000000000633E000-memory.dmp

            Filesize

            120KB

          • memory/3288-165-0x00000000051E0000-0x000000000521C000-memory.dmp

            Filesize

            240KB

          • memory/3288-166-0x0000000005260000-0x0000000005270000-memory.dmp

            Filesize

            64KB

          • memory/4352-161-0x0000000004BD0000-0x0000000004C62000-memory.dmp

            Filesize

            584KB

          • memory/4352-168-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

            Filesize

            40KB

          • memory/4352-167-0x0000000004EF0000-0x0000000004F00000-memory.dmp

            Filesize

            64KB

          • memory/4352-164-0x0000000004B50000-0x0000000004BB6000-memory.dmp

            Filesize

            408KB

          • memory/4352-163-0x0000000004C70000-0x0000000004D0C000-memory.dmp

            Filesize

            624KB

          • memory/4352-159-0x0000000005180000-0x0000000005724000-memory.dmp

            Filesize

            5.6MB

          • memory/4352-157-0x0000000000110000-0x00000000002FA000-memory.dmp

            Filesize

            1.9MB