2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57

Analysis

max time kernel
108s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2023, 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe
Size

559KB
MD5

2ed975bca125e3df12a654ba67f293e3
SHA1

ed4a367dfe5ec19860debcae9ea12d6c7077ff26
SHA256

2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57
SHA512

b21e02615b588deb3822ffbe04e4ab07eaabb39c36806ca2c3938b0c674b7e236af00385b8f10f94b2f2c57d6b46a3a7d46243f2b03cbab762763370c2a436fa
SSDEEP

12288:sy90pfspWpAwg/PI0xM6bFTia4ekFc9KKMVVbBJTodz3bA:syuA2AwgPM6CRW9dKNc3M

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it749000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it749000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it749000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it749000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it749000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it749000.exe

Executes dropped EXE 4 IoCs

pid	Process
2256	zixb4613.exe
3952	it749000.exe
3472	kp452426.exe
2516	lr069495.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it749000.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zixb4613.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zixb4613.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4756	3472	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3952	it749000.exe
3952	it749000.exe
3472	kp452426.exe
3472	kp452426.exe
2516	lr069495.exe
2516	lr069495.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	it749000.exe
Token: SeDebugPrivilege	3472	kp452426.exe
Token: SeDebugPrivilege	2516	lr069495.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2256	2240	2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe	86
PID 2240 wrote to memory of 2256	2240	2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe	86
PID 2240 wrote to memory of 2256	2240	2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe	86
PID 2256 wrote to memory of 3952	2256	zixb4613.exe	87
PID 2256 wrote to memory of 3952	2256	zixb4613.exe	87
PID 2256 wrote to memory of 3472	2256	zixb4613.exe	92
PID 2256 wrote to memory of 3472	2256	zixb4613.exe	92
PID 2256 wrote to memory of 3472	2256	zixb4613.exe	92
PID 2240 wrote to memory of 2516	2240	2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe	98
PID 2240 wrote to memory of 2516	2240	2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe	98
PID 2240 wrote to memory of 2516	2240	2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe	98

C:\Users\Admin\AppData\Local\Temp\2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe
"C:\Users\Admin\AppData\Local\Temp\2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 1324
      4⤵
      Program crash
      PID:4756
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3472 -ip 3472
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exe

Filesize
136KB

MD5
49650cdcdc358bb2770f0062abeef88c

SHA1
d6f7ec7758e9a80700b81bc7a549838ba99aacac

SHA256
79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

SHA512
7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exe

Filesize
136KB

MD5
49650cdcdc358bb2770f0062abeef88c

SHA1
d6f7ec7758e9a80700b81bc7a549838ba99aacac

SHA256
79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

SHA512
7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exe

Filesize
405KB

MD5
83be0edc6067ee65aa6c1b1a287df491

SHA1
b362c7ffc0ece0b5e1b2ece45004f745f798dfd1

SHA256
513f7dc8f128b53aae0c5621caa099d2447819ed142b8630a8032cdabf3bd384

SHA512
fea7fc0217b3c085465893155b56c8ca95151af8da4739d3dae32fa06f9c5ebd1909f3d516dcc34d3e6097b62cf6343a7808f757b9d651adf75863ace6a620ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exe

Filesize
405KB

MD5
83be0edc6067ee65aa6c1b1a287df491

SHA1
b362c7ffc0ece0b5e1b2ece45004f745f798dfd1

SHA256
513f7dc8f128b53aae0c5621caa099d2447819ed142b8630a8032cdabf3bd384

SHA512
fea7fc0217b3c085465893155b56c8ca95151af8da4739d3dae32fa06f9c5ebd1909f3d516dcc34d3e6097b62cf6343a7808f757b9d651adf75863ace6a620ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exe

Filesize
352KB

MD5
46ec95b8990a01edc2e31bb4b44c61d7

SHA1
abf327ec4384751c385fa29d174c6ab79c751eef

SHA256
23197dd28100c5a37cbab387c2f6285a39d76d1025f8649504a441c66bb90a9f

SHA512
2415d379c1919059026349e124ce05b8166cb91bf901a5918ca0e2f9951acb17358dde9ac506c1be4a22a9b671809851a5f81631bcc5eac082b96fe1af5496cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exe

Filesize
352KB

MD5
46ec95b8990a01edc2e31bb4b44c61d7

SHA1
abf327ec4384751c385fa29d174c6ab79c751eef

SHA256
23197dd28100c5a37cbab387c2f6285a39d76d1025f8649504a441c66bb90a9f

SHA512
2415d379c1919059026349e124ce05b8166cb91bf901a5918ca0e2f9951acb17358dde9ac506c1be4a22a9b671809851a5f81631bcc5eac082b96fe1af5496cc

Download Submit
memory/2516-970-0x00000000001E0000-0x0000000000208000-memory.dmp

Filesize
160KB

Download
memory/2516-971-0x0000000007450000-0x0000000007460000-memory.dmp

Filesize
64KB

Download
memory/3472-188-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-202-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-154-0x0000000002BD0000-0x0000000002C16000-memory.dmp

Filesize
280KB

Download
memory/3472-156-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/3472-157-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-158-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-160-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-162-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-164-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-166-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-168-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-170-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-172-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-174-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-176-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-178-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-180-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-182-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-184-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-186-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-153-0x00000000073B0000-0x0000000007954000-memory.dmp

Filesize
5.6MB

Download
memory/3472-190-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-192-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-194-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-196-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-198-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-200-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-155-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/3472-204-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-206-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-208-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-210-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-212-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-214-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-216-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-218-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-220-0x0000000004B80000-0x0000000004BB5000-memory.dmp

Filesize
212KB

Download
memory/3472-949-0x0000000009CE0000-0x000000000A2F8000-memory.dmp

Filesize
6.1MB

Download
memory/3472-950-0x000000000A320000-0x000000000A332000-memory.dmp

Filesize
72KB

Download
memory/3472-951-0x000000000A340000-0x000000000A44A000-memory.dmp

Filesize
1.0MB

Download
memory/3472-952-0x000000000A460000-0x000000000A49C000-memory.dmp

Filesize
240KB

Download
memory/3472-953-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/3472-954-0x000000000A760000-0x000000000A7C6000-memory.dmp

Filesize
408KB

Download
memory/3472-955-0x000000000AE20000-0x000000000AEB2000-memory.dmp

Filesize
584KB

Download
memory/3472-956-0x000000000AEF0000-0x000000000AF40000-memory.dmp

Filesize
320KB

Download
memory/3472-957-0x000000000AF40000-0x000000000AFB6000-memory.dmp

Filesize
472KB

Download
memory/3472-958-0x000000000B010000-0x000000000B1D2000-memory.dmp

Filesize
1.8MB

Download
memory/3472-959-0x000000000B1F0000-0x000000000B71C000-memory.dmp

Filesize
5.2MB

Download
memory/3472-960-0x000000000B7A0000-0x000000000B7BE000-memory.dmp

Filesize
120KB

Download
memory/3472-963-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/3472-964-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/3472-965-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/3952-147-0x00000000006C0000-0x00000000006CA000-memory.dmp

Filesize
40KB

Download