Analysis
-
max time kernel
50s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
22/04/2023, 01:50
Static task
static1
General
-
Target
5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe
-
Size
568KB
-
MD5
e163a70cfd6813b062121e597e74a07c
-
SHA1
06b5aa47b9d7d771c6e83cd27d39eb67cf3981ce
-
SHA256
5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da
-
SHA512
96d178d2f8841a7765612cdb3e404e0134c3d35facf8bb93ee3b4ea9b8ff13c55373565e3cc6a977bb2589bf9a3c9c6c33d22ff778f79f69ae0b469694c80064
-
SSDEEP
12288:Qy90SjjHzRVp7Ke0lOS/DSbrriYtOaheIMg/veImXNuUF:QyPjH3+T/DHYtJvv8XNd
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it692300.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it692300.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it692300.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it692300.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it692300.exe -
Executes dropped EXE 4 IoCs
pid Process 2344 ziNH0521.exe 2420 it692300.exe 2892 kp754509.exe 2052 lr621978.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it692300.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziNH0521.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziNH0521.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2420 it692300.exe 2420 it692300.exe 2892 kp754509.exe 2892 kp754509.exe 2052 lr621978.exe 2052 lr621978.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2420 it692300.exe Token: SeDebugPrivilege 2892 kp754509.exe Token: SeDebugPrivilege 2052 lr621978.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2344 1780 5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe 66 PID 1780 wrote to memory of 2344 1780 5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe 66 PID 1780 wrote to memory of 2344 1780 5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe 66 PID 2344 wrote to memory of 2420 2344 ziNH0521.exe 67 PID 2344 wrote to memory of 2420 2344 ziNH0521.exe 67 PID 2344 wrote to memory of 2892 2344 ziNH0521.exe 68 PID 2344 wrote to memory of 2892 2344 ziNH0521.exe 68 PID 2344 wrote to memory of 2892 2344 ziNH0521.exe 68 PID 1780 wrote to memory of 2052 1780 5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe 70 PID 1780 wrote to memory of 2052 1780 5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe 70 PID 1780 wrote to memory of 2052 1780 5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe"C:\Users\Admin\AppData\Local\Temp\5e0d0db17534f93b711d12b8474324239bb9b1d14d9a692f755e2759319760da.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNH0521.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNH0521.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it692300.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it692300.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp754509.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp754509.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr621978.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr621978.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD59c75a048f066d01b19ed80dc6e7a7101
SHA17d37c8ef50e8b83fcdd44032fb082f226ab3d8c3
SHA256c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625
SHA512b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33
-
Filesize
136KB
MD59c75a048f066d01b19ed80dc6e7a7101
SHA17d37c8ef50e8b83fcdd44032fb082f226ab3d8c3
SHA256c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625
SHA512b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33
-
Filesize
414KB
MD530f322163e1ece7c5e63ba566be34319
SHA160e3c3c4920d4bbca8f69c4420cc4d279cac1c28
SHA256affca9f24a01fc9ffd1cd424e756c0c4773f6160d57a945660242c3276c7b15c
SHA51297eb331dd629914fa6b1df737d1f52e840442b1f87ed8cf6675d3cc275df41f78fbb71c22d6f3344aa8e147ffbdc708a6088251c833fb6f0c65a9607f317254a
-
Filesize
414KB
MD530f322163e1ece7c5e63ba566be34319
SHA160e3c3c4920d4bbca8f69c4420cc4d279cac1c28
SHA256affca9f24a01fc9ffd1cd424e756c0c4773f6160d57a945660242c3276c7b15c
SHA51297eb331dd629914fa6b1df737d1f52e840442b1f87ed8cf6675d3cc275df41f78fbb71c22d6f3344aa8e147ffbdc708a6088251c833fb6f0c65a9607f317254a
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
381KB
MD53f1cf73d7b5bcad61deb1dd614eac274
SHA125a6201b7a2814e873aaa3faca429147a64b1b97
SHA256161f31edfaf87f4ba3ea32873c49c480f0bd611af7563d7a9832a304e1048d0f
SHA512dda4284a5c1c4feedb644b30d3e42bf112fa128bc5fc0541188be325c015c44b5473621a621d650b8c70d75c2debfc836d117142d97c099acc4eb23ff6e6e91d
-
Filesize
381KB
MD53f1cf73d7b5bcad61deb1dd614eac274
SHA125a6201b7a2814e873aaa3faca429147a64b1b97
SHA256161f31edfaf87f4ba3ea32873c49c480f0bd611af7563d7a9832a304e1048d0f
SHA512dda4284a5c1c4feedb644b30d3e42bf112fa128bc5fc0541188be325c015c44b5473621a621d650b8c70d75c2debfc836d117142d97c099acc4eb23ff6e6e91d