Analysis

  • max time kernel
    50s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/04/2023, 01:50

General

  • Target

    5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe

  • Size

    568KB

  • MD5

    e163a70cfd6813b062121e597e74a07c

  • SHA1

    06b5aa47b9d7d771c6e83cd27d39eb67cf3981ce

  • SHA256

    5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da

  • SHA512

    96d178d2f8841a7765612cdb3e404e0134c3d35facf8bb93ee3b4ea9b8ff13c55373565e3cc6a977bb2589bf9a3c9c6c33d22ff778f79f69ae0b469694c80064

  • SSDEEP

    12288:Qy90SjjHzRVp7Ke0lOS/DSbrriYtOaheIMg/veImXNuUF:QyPjH3+T/DHYtJvv8XNd

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe
    "C:\Users\Admin\AppData\Local\Temp\5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNH0521.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNH0521.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it692300.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it692300.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2420
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp754509.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp754509.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2892
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr621978.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr621978.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2052

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr621978.exe

    Filesize

    136KB

    MD5

    9c75a048f066d01b19ed80dc6e7a7101

    SHA1

    7d37c8ef50e8b83fcdd44032fb082f226ab3d8c3

    SHA256

    c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625

    SHA512

    b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr621978.exe

    Filesize

    136KB

    MD5

    9c75a048f066d01b19ed80dc6e7a7101

    SHA1

    7d37c8ef50e8b83fcdd44032fb082f226ab3d8c3

    SHA256

    c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625

    SHA512

    b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNH0521.exe

    Filesize

    414KB

    MD5

    30f322163e1ece7c5e63ba566be34319

    SHA1

    60e3c3c4920d4bbca8f69c4420cc4d279cac1c28

    SHA256

    affca9f24a01fc9ffd1cd424e756c0c4773f6160d57a945660242c3276c7b15c

    SHA512

    97eb331dd629914fa6b1df737d1f52e840442b1f87ed8cf6675d3cc275df41f78fbb71c22d6f3344aa8e147ffbdc708a6088251c833fb6f0c65a9607f317254a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNH0521.exe

    Filesize

    414KB

    MD5

    30f322163e1ece7c5e63ba566be34319

    SHA1

    60e3c3c4920d4bbca8f69c4420cc4d279cac1c28

    SHA256

    affca9f24a01fc9ffd1cd424e756c0c4773f6160d57a945660242c3276c7b15c

    SHA512

    97eb331dd629914fa6b1df737d1f52e840442b1f87ed8cf6675d3cc275df41f78fbb71c22d6f3344aa8e147ffbdc708a6088251c833fb6f0c65a9607f317254a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it692300.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it692300.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp754509.exe

    Filesize

    381KB

    MD5

    3f1cf73d7b5bcad61deb1dd614eac274

    SHA1

    25a6201b7a2814e873aaa3faca429147a64b1b97

    SHA256

    161f31edfaf87f4ba3ea32873c49c480f0bd611af7563d7a9832a304e1048d0f

    SHA512

    dda4284a5c1c4feedb644b30d3e42bf112fa128bc5fc0541188be325c015c44b5473621a621d650b8c70d75c2debfc836d117142d97c099acc4eb23ff6e6e91d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp754509.exe

    Filesize

    381KB

    MD5

    3f1cf73d7b5bcad61deb1dd614eac274

    SHA1

    25a6201b7a2814e873aaa3faca429147a64b1b97

    SHA256

    161f31edfaf87f4ba3ea32873c49c480f0bd611af7563d7a9832a304e1048d0f

    SHA512

    dda4284a5c1c4feedb644b30d3e42bf112fa128bc5fc0541188be325c015c44b5473621a621d650b8c70d75c2debfc836d117142d97c099acc4eb23ff6e6e91d

  • memory/2052-958-0x00000000006B0000-0x00000000006D8000-memory.dmp

    Filesize

    160KB

  • memory/2052-959-0x0000000007430000-0x000000000747B000-memory.dmp

    Filesize

    300KB

  • memory/2052-960-0x00000000077B0000-0x00000000077C0000-memory.dmp

    Filesize

    64KB

  • memory/2420-135-0x0000000000620000-0x000000000062A000-memory.dmp

    Filesize

    40KB

  • memory/2892-186-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-210-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-145-0x0000000007380000-0x0000000007390000-memory.dmp

    Filesize

    64KB

  • memory/2892-146-0x0000000007380000-0x0000000007390000-memory.dmp

    Filesize

    64KB

  • memory/2892-144-0x0000000002BD0000-0x0000000002C16000-memory.dmp

    Filesize

    280KB

  • memory/2892-147-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-148-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-150-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-162-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-160-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-158-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-164-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-166-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-156-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-154-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-152-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-168-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-176-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-178-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-184-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-142-0x0000000007390000-0x000000000788E000-memory.dmp

    Filesize

    5.0MB

  • memory/2892-194-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-196-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-200-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-208-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-143-0x0000000004850000-0x000000000488A000-memory.dmp

    Filesize

    232KB

  • memory/2892-206-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-204-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-202-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-198-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-192-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-190-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-188-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-182-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-180-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-174-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-172-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-170-0x0000000004850000-0x0000000004885000-memory.dmp

    Filesize

    212KB

  • memory/2892-939-0x000000000A220000-0x000000000A826000-memory.dmp

    Filesize

    6.0MB

  • memory/2892-940-0x0000000009C10000-0x0000000009C22000-memory.dmp

    Filesize

    72KB

  • memory/2892-941-0x0000000009C30000-0x0000000009D3A000-memory.dmp

    Filesize

    1.0MB

  • memory/2892-942-0x0000000009D50000-0x0000000009D8E000-memory.dmp

    Filesize

    248KB

  • memory/2892-943-0x0000000009ED0000-0x0000000009F1B000-memory.dmp

    Filesize

    300KB

  • memory/2892-944-0x0000000007380000-0x0000000007390000-memory.dmp

    Filesize

    64KB

  • memory/2892-945-0x000000000A060000-0x000000000A0C6000-memory.dmp

    Filesize

    408KB

  • memory/2892-946-0x000000000AD30000-0x000000000ADC2000-memory.dmp

    Filesize

    584KB

  • memory/2892-947-0x000000000AED0000-0x000000000AF20000-memory.dmp

    Filesize

    320KB

  • memory/2892-141-0x0000000004750000-0x000000000478C000-memory.dmp

    Filesize

    240KB

  • memory/2892-948-0x000000000AF40000-0x000000000AFB6000-memory.dmp

    Filesize

    472KB

  • memory/2892-949-0x000000000AFE0000-0x000000000AFFE000-memory.dmp

    Filesize

    120KB

  • memory/2892-950-0x000000000B1E0000-0x000000000B3A2000-memory.dmp

    Filesize

    1.8MB

  • memory/2892-951-0x000000000B3C0000-0x000000000B8EC000-memory.dmp

    Filesize

    5.2MB