Analysis

  • max time kernel
    144s
  • max time network
    139s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/04/2023, 23:28

General

  • Target

    b3e128766755a249f058b8af014edd0d63d78807642a5c6091d6e249095dc123.exe

  • Size

    920KB

  • MD5

    a3f0b6d0e55179bcef554f2e5295f332

  • SHA1

    550fd9f3e85ce06bb96f6003c356553da9a9d6fd

  • SHA256

    b3e128766755a249f058b8af014edd0d63d78807642a5c6091d6e249095dc123

  • SHA512

    46b38ac8973d12c73f328a22954c85858b86815857e1b1ea298311fc761b4414c091e3e3c1bc1ad55f4fd537f9016248802cd099d17c56f933a2069095508f63

  • SSDEEP

    24576:myJ7rPvW+id/Z4DOlK2OaTK4Atm7uBYIaX9u:1J7Lzid/Z5vuqIo9

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3e128766755a249f058b8af014edd0d63d78807642a5c6091d6e249095dc123.exe
    "C:\Users\Admin\AppData\Local\Temp\b3e128766755a249f058b8af014edd0d63d78807642a5c6091d6e249095dc123.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidD3943.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidD3943.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3548
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziyF7992.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziyF7992.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it658394.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it658394.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5108
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr154519.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr154519.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4916
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp830302.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp830302.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2164
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr969360.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr969360.exe
      2⤵
      • Executes dropped EXE
      PID:2528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 616
        3⤵
        • Program crash
        PID:3588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 696
        3⤵
        • Program crash
        PID:2368
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 836
        3⤵
        • Program crash
        PID:5100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 620
        3⤵
        • Program crash
        PID:4920
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 864
        3⤵
        • Program crash
        PID:4232
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 880
        3⤵
        • Program crash
        PID:4248
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1124
        3⤵
        • Program crash
        PID:304
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1144
        3⤵
        • Program crash
        PID:3956
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1108
        3⤵
        • Program crash
        PID:1472

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr969360.exe

    Filesize

    367KB

    MD5

    1f2d110420136746d089248885ff7de9

    SHA1

    6018db5c1daeebe645078dd13271e3dca6d69c87

    SHA256

    a858743e72c1d27c1cdd65c6bd2631cd71eddc72c44931d408de22c2d785b563

    SHA512

    e9bc0b1cf3f3ab51e05e0bd067d0159a0c82fa33ff0fde8e6b1fd39cc489bb52a5385fc5f3b6855e452ad8c8d69d80385624d35466117997b5263c726f09baab

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr969360.exe

    Filesize

    367KB

    MD5

    1f2d110420136746d089248885ff7de9

    SHA1

    6018db5c1daeebe645078dd13271e3dca6d69c87

    SHA256

    a858743e72c1d27c1cdd65c6bd2631cd71eddc72c44931d408de22c2d785b563

    SHA512

    e9bc0b1cf3f3ab51e05e0bd067d0159a0c82fa33ff0fde8e6b1fd39cc489bb52a5385fc5f3b6855e452ad8c8d69d80385624d35466117997b5263c726f09baab

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidD3943.exe

    Filesize

    616KB

    MD5

    80482c2ad303dd3a021218188e900394

    SHA1

    9778a9cf53c8b30c9371e252bb2fa97237bf3ed6

    SHA256

    e40ae6c4f87d0f229b1239ee6ab5d6d5d6f04dcc9ee3b0350644c1018763af3e

    SHA512

    2b7756c09d1ea93e84f79a8d4ba2583c78c9a54886b75238b7e60f8a45964b2a731ceec4aad9821711b43156f5fc4a3da18a2e1df56b28657ba1f1811ed25b63

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidD3943.exe

    Filesize

    616KB

    MD5

    80482c2ad303dd3a021218188e900394

    SHA1

    9778a9cf53c8b30c9371e252bb2fa97237bf3ed6

    SHA256

    e40ae6c4f87d0f229b1239ee6ab5d6d5d6f04dcc9ee3b0350644c1018763af3e

    SHA512

    2b7756c09d1ea93e84f79a8d4ba2583c78c9a54886b75238b7e60f8a45964b2a731ceec4aad9821711b43156f5fc4a3da18a2e1df56b28657ba1f1811ed25b63

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp830302.exe

    Filesize

    136KB

    MD5

    ac0ffc4fceebe7be421ae8fc8517d1bf

    SHA1

    fa6a6f1878e561b5401ae36422add3d34cfdf6dd

    SHA256

    fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718

    SHA512

    23de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp830302.exe

    Filesize

    136KB

    MD5

    ac0ffc4fceebe7be421ae8fc8517d1bf

    SHA1

    fa6a6f1878e561b5401ae36422add3d34cfdf6dd

    SHA256

    fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718

    SHA512

    23de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziyF7992.exe

    Filesize

    461KB

    MD5

    3d33d8feab29ea2f6af562ddec96914b

    SHA1

    c1a4a439b6c97e500377a63e229a5355d58af4cb

    SHA256

    25aee678051c0e6790da4526faa63ac4f863bc5f1fecbc3caf64d7d18ffaa718

    SHA512

    6fa046e1554f38b14bb7d02dc70d5618b0369e80f1533e5252b8f681d284da97638c8ec7b90c858517dc198c994ed44fd4b127b1cac1aef07b29c26b784d4ce6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziyF7992.exe

    Filesize

    461KB

    MD5

    3d33d8feab29ea2f6af562ddec96914b

    SHA1

    c1a4a439b6c97e500377a63e229a5355d58af4cb

    SHA256

    25aee678051c0e6790da4526faa63ac4f863bc5f1fecbc3caf64d7d18ffaa718

    SHA512

    6fa046e1554f38b14bb7d02dc70d5618b0369e80f1533e5252b8f681d284da97638c8ec7b90c858517dc198c994ed44fd4b127b1cac1aef07b29c26b784d4ce6

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it658394.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it658394.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr154519.exe

    Filesize

    472KB

    MD5

    ad7cd24b375381457e12aad60b7b0357

    SHA1

    53eacffcd42f036c74b4baef177a40a4aa549b90

    SHA256

    82865bd4c6a00175bb54c25caa14813789255e69ae4503bbf6bb78a1c0e66a7b

    SHA512

    7e59987ec116c1122080f9120b107d2c2e600343930e7fcb1e4a6d8321b2a86ad9390f3c43552cf06aeec545d52d7dae1a2f473da0bef16fdeda43b4e641c98a

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr154519.exe

    Filesize

    472KB

    MD5

    ad7cd24b375381457e12aad60b7b0357

    SHA1

    53eacffcd42f036c74b4baef177a40a4aa549b90

    SHA256

    82865bd4c6a00175bb54c25caa14813789255e69ae4503bbf6bb78a1c0e66a7b

    SHA512

    7e59987ec116c1122080f9120b107d2c2e600343930e7fcb1e4a6d8321b2a86ad9390f3c43552cf06aeec545d52d7dae1a2f473da0bef16fdeda43b4e641c98a

  • memory/2164-961-0x0000000007680000-0x00000000076CB000-memory.dmp

    Filesize

    300KB

  • memory/2164-960-0x00000000008D0000-0x00000000008F8000-memory.dmp

    Filesize

    160KB

  • memory/2164-962-0x0000000007630000-0x0000000007640000-memory.dmp

    Filesize

    64KB

  • memory/2528-968-0x00000000008D0000-0x0000000000905000-memory.dmp

    Filesize

    212KB

  • memory/4916-179-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-197-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-149-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4916-150-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-151-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-153-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-155-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-157-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-159-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-161-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-163-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-165-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-167-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-169-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-171-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-173-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-175-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-177-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-147-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4916-181-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-183-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-185-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-187-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-189-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-191-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-193-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-195-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-148-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4916-199-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-201-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-203-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-205-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-207-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-209-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-211-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-213-0x0000000004DD0000-0x0000000004E05000-memory.dmp

    Filesize

    212KB

  • memory/4916-942-0x0000000007870000-0x0000000007E76000-memory.dmp

    Filesize

    6.0MB

  • memory/4916-943-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

    Filesize

    72KB

  • memory/4916-944-0x0000000007E90000-0x0000000007F9A000-memory.dmp

    Filesize

    1.0MB

  • memory/4916-945-0x0000000007FB0000-0x0000000007FEE000-memory.dmp

    Filesize

    248KB

  • memory/4916-946-0x0000000008030000-0x000000000807B000-memory.dmp

    Filesize

    300KB

  • memory/4916-947-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4916-948-0x00000000082C0000-0x0000000008326000-memory.dmp

    Filesize

    408KB

  • memory/4916-949-0x0000000008AB0000-0x0000000008B42000-memory.dmp

    Filesize

    584KB

  • memory/4916-950-0x0000000008C80000-0x0000000008CF6000-memory.dmp

    Filesize

    472KB

  • memory/4916-146-0x0000000000820000-0x0000000000866000-memory.dmp

    Filesize

    280KB

  • memory/4916-145-0x0000000004DD0000-0x0000000004E0A000-memory.dmp

    Filesize

    232KB

  • memory/4916-144-0x0000000004EF0000-0x00000000053EE000-memory.dmp

    Filesize

    5.0MB

  • memory/4916-143-0x0000000002900000-0x000000000293C000-memory.dmp

    Filesize

    240KB

  • memory/4916-951-0x0000000008D40000-0x0000000008F02000-memory.dmp

    Filesize

    1.8MB

  • memory/4916-952-0x0000000008F20000-0x000000000944C000-memory.dmp

    Filesize

    5.2MB

  • memory/4916-953-0x0000000009570000-0x000000000958E000-memory.dmp

    Filesize

    120KB

  • memory/4916-954-0x00000000023F0000-0x0000000002440000-memory.dmp

    Filesize

    320KB

  • memory/5108-137-0x0000000000830000-0x000000000083A000-memory.dmp

    Filesize

    40KB