9a8dac8d56137fde3518444d5d2fc1a2047ca8818292cbd9f4d1474a049d626c

General

Target

version_v317.exe
Size

1.1MB
MD5

a3379dd436b5eaf0aa9b347298491ceb
SHA1

90c8b1db730f5d17a7bc04523564499c1b0e330f
SHA256

e41280f90eb285ec8e429cf6e9a74df539ae78bcf6c210308f33857cc764042b
SHA512

bb6b85c8ef5f572a301157328a3c14a2d4ccbf8e6d3e55a73406aca4c770da47559035dba36f2a1efb6a7b91ba5f6f9a5ceb3b73ad63730d3ffd7638729f5f6f
SSDEEP

24576:C9ZoIWr9cVcQWbWqH2KwpJuMKgaFqAvg:HXqpJ4g

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

version_v317.exe

description pid process target process

PID 1692 set thread context of 1008 1692 version_v317.exe version_v317.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

612 1008 WerFault.exe version_v317.exe

flow	ioc
8	ip-api.com

description	pid	process	target process
PID 1692 set thread context of 1008	1692	version_v317.exe	version_v317.exe

pid	pid_target	process	target process
612	1008	WerFault.exe	version_v317.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

version_v317.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	version_v317.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	version_v317.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exeversion_v317.exe

pid process

1332 powershell.exe
1008 version_v317.exe
1008 version_v317.exe
1008 version_v317.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

version_v317.exepowershell.exeversion_v317.exe

description pid process

Token: SeDebugPrivilege 1692 version_v317.exe
Token: SeDebugPrivilege 1332 powershell.exe
Token: SeDebugPrivilege 1008 version_v317.exe

pid	process
1332	powershell.exe
1008	version_v317.exe
1008	version_v317.exe
1008	version_v317.exe

description	pid	process
Token: SeDebugPrivilege	1692	version_v317.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1008	version_v317.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

version_v317.exeversion_v317.exe

description	pid	process	target process
PID 1692 wrote to memory of 1332	1692	version_v317.exe	powershell.exe
PID 1692 wrote to memory of 1332	1692	version_v317.exe	powershell.exe
PID 1692 wrote to memory of 1332	1692	version_v317.exe	powershell.exe
PID 1692 wrote to memory of 1332	1692	version_v317.exe	powershell.exe
PID 1692 wrote to memory of 1008	1692	version_v317.exe	version_v317.exe
PID 1692 wrote to memory of 1008	1692	version_v317.exe	version_v317.exe
PID 1692 wrote to memory of 1008	1692	version_v317.exe	version_v317.exe
PID 1692 wrote to memory of 1008	1692	version_v317.exe	version_v317.exe
PID 1692 wrote to memory of 1008	1692	version_v317.exe	version_v317.exe
PID 1692 wrote to memory of 1008	1692	version_v317.exe	version_v317.exe
PID 1692 wrote to memory of 1008	1692	version_v317.exe	version_v317.exe
PID 1692 wrote to memory of 1008	1692	version_v317.exe	version_v317.exe
PID 1692 wrote to memory of 1008	1692	version_v317.exe	version_v317.exe
PID 1008 wrote to memory of 612	1008	version_v317.exe	WerFault.exe
PID 1008 wrote to memory of 612	1008	version_v317.exe	WerFault.exe
PID 1008 wrote to memory of 612	1008	version_v317.exe	WerFault.exe
PID 1008 wrote to memory of 612	1008	version_v317.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\version_v317.exe
"C:\Users\Admin\AppData\Local\Temp\version_v317.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Users\Admin\AppData\Local\Temp\version_v317.exe
C:\Users\Admin\AppData\Local\Temp\version_v317.exe
2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 1716
3⤵
- Program crash
PID:612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\f595450f715ebe11c3af8f7c7753b8d9\Admin@BPOQNXYB_en-US_2023_03_21_20_39_51@v1.3\Software.txt
Filesize
4KB

MD5
0deddb3cd02f97a1b29228e249b3b365

SHA1
fecda2c925798a04ad17871124a441dd96ae1730

SHA256
f347f9e4d3dd0ce266a5d225c0471e33386c659c6c2425a1b2e625864e538b9b

SHA512
23d186926572a79bd7cec17ddfc8dc49e97097636cf34cdbc4a8b3d6b590362635cb41200da96385cbc9da4d255cef65bf5bf2cd964c37c331ef9d1dec50eeb0

Download Submit
memory/1008-74-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1008-76-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1008-67-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1008-69-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1008-167-0x0000000005060000-0x00000000050A0000-memory.dmp

Filesize
256KB

Download
memory/1008-162-0x0000000005060000-0x00000000050A0000-memory.dmp

Filesize
256KB

Download
memory/1008-77-0x0000000005060000-0x00000000050A0000-memory.dmp

Filesize
256KB

Download
memory/1008-72-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1008-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1008-70-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1008-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1008-168-0x0000000005060000-0x00000000050A0000-memory.dmp

Filesize
256KB

Download
memory/1332-66-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1332-64-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1332-65-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1332-62-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1332-61-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1332-60-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1692-57-0x0000000005820000-0x00000000058B2000-memory.dmp

Filesize
584KB

Download
memory/1692-56-0x0000000005D10000-0x0000000005E5E000-memory.dmp

Filesize
1.3MB

Download
memory/1692-54-0x0000000000200000-0x000000000031C000-memory.dmp

Filesize
1.1MB

Download
memory/1692-63-0x0000000004D50000-0x0000000004D90000-memory.dmp

Filesize
256KB

Download
memory/1692-55-0x0000000004D50000-0x0000000004D90000-memory.dmp

Filesize
256KB

Download

Resubmissions

Analysis

Sharing