Analysis

  • max time kernel
    85s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 23:40

General

  • Target

    038ec5eac8312f688db094973f6d872ad32a9a63124db6b2259131060ca5d81d.exe

  • Size

    564KB

  • MD5

    1c6acdb718917fabd9f75705b2cc3581

  • SHA1

    ae3ef9f8224028ee9706e926534e73fcf22e3a9a

  • SHA256

    038ec5eac8312f688db094973f6d872ad32a9a63124db6b2259131060ca5d81d

  • SHA512

    ad0d6eb710b924a9fe28c00f9a3b4eb20d79255e5522b903168e1219b61ed1d0a2bf943496be7867a78a9891708d345f8f17d86dabab22afeeb8bf29f61cc463

  • SSDEEP

    12288:vy90f2UZNLHyKSVXgDUKi7foJ3ICLzN0tv0nMTJIyq6qYrx8cY:vy5YSFVXgOMzXmtv08O7nyx83

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\038ec5eac8312f688db094973f6d872ad32a9a63124db6b2259131060ca5d81d.exe
    "C:\Users\Admin\AppData\Local\Temp\038ec5eac8312f688db094973f6d872ad32a9a63124db6b2259131060ca5d81d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRn2228.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRn2228.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it098433.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it098433.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4728
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp400330.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp400330.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3356
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1712
          4⤵
          • Program crash
          PID:4240
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr230304.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr230304.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4132
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3356 -ip 3356
    1⤵
      PID:4536

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr230304.exe

            Filesize

            136KB

            MD5

            ace73b2b1f835de11594ea9a243a9f5c

            SHA1

            2f929d1f69784fbe499a95b064679a16947bdd84

            SHA256

            7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

            SHA512

            024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr230304.exe

            Filesize

            136KB

            MD5

            ace73b2b1f835de11594ea9a243a9f5c

            SHA1

            2f929d1f69784fbe499a95b064679a16947bdd84

            SHA256

            7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

            SHA512

            024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRn2228.exe

            Filesize

            409KB

            MD5

            efa3c5d886cd92ea6fc044d3240e40ec

            SHA1

            4fcb13914a076764833b61bf1ad3e87c68a574ac

            SHA256

            6cf71391fa90668ab30d28cba157eb30dbe0a4faaeb7d256c027360f20b1d55e

            SHA512

            4607c42356950a98bf8c8c44dd3555ace67f7f476ef01c353fd258ba481060eaf09d0e01cd21662727de13eaf604f138f6b30086bf3b2201d1a3b821053c572d

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRn2228.exe

            Filesize

            409KB

            MD5

            efa3c5d886cd92ea6fc044d3240e40ec

            SHA1

            4fcb13914a076764833b61bf1ad3e87c68a574ac

            SHA256

            6cf71391fa90668ab30d28cba157eb30dbe0a4faaeb7d256c027360f20b1d55e

            SHA512

            4607c42356950a98bf8c8c44dd3555ace67f7f476ef01c353fd258ba481060eaf09d0e01cd21662727de13eaf604f138f6b30086bf3b2201d1a3b821053c572d

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it098433.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it098433.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp400330.exe

            Filesize

            361KB

            MD5

            88344677faee2a6e862b820c3963297f

            SHA1

            d6f547c93a5f2aa6231649f9a44d5d3e3decab30

            SHA256

            02022aecd1a1b1359bfe126a620172d2ee648df92f11a4ab1ef51d9edf918719

            SHA512

            d2e4e2ee1c8ad424a89584ad249727eb4796e0f27587a34b09f6606b81ade18c1376c6aaf8c06d3a764c0e1f8bf33553808804665ef7008669925ee3b342e9b6

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp400330.exe

            Filesize

            361KB

            MD5

            88344677faee2a6e862b820c3963297f

            SHA1

            d6f547c93a5f2aa6231649f9a44d5d3e3decab30

            SHA256

            02022aecd1a1b1359bfe126a620172d2ee648df92f11a4ab1ef51d9edf918719

            SHA512

            d2e4e2ee1c8ad424a89584ad249727eb4796e0f27587a34b09f6606b81ade18c1376c6aaf8c06d3a764c0e1f8bf33553808804665ef7008669925ee3b342e9b6

          • memory/3356-153-0x0000000004560000-0x00000000045A6000-memory.dmp

            Filesize

            280KB

          • memory/3356-154-0x00000000071F0000-0x0000000007794000-memory.dmp

            Filesize

            5.6MB

          • memory/3356-155-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-158-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-156-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-160-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-162-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-164-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-166-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-168-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-170-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-172-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-176-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-178-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-174-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-180-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-182-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-186-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-184-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-188-0x00000000071E0000-0x00000000071F0000-memory.dmp

            Filesize

            64KB

          • memory/3356-189-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-190-0x00000000071E0000-0x00000000071F0000-memory.dmp

            Filesize

            64KB

          • memory/3356-192-0x00000000071E0000-0x00000000071F0000-memory.dmp

            Filesize

            64KB

          • memory/3356-195-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-193-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-197-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-201-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-203-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-199-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-205-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-207-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-209-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-211-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-213-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-215-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-217-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-219-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-221-0x0000000007180000-0x00000000071B5000-memory.dmp

            Filesize

            212KB

          • memory/3356-950-0x0000000009C60000-0x000000000A278000-memory.dmp

            Filesize

            6.1MB

          • memory/3356-951-0x000000000A320000-0x000000000A332000-memory.dmp

            Filesize

            72KB

          • memory/3356-952-0x000000000A340000-0x000000000A44A000-memory.dmp

            Filesize

            1.0MB

          • memory/3356-953-0x000000000A460000-0x000000000A49C000-memory.dmp

            Filesize

            240KB

          • memory/3356-954-0x00000000071E0000-0x00000000071F0000-memory.dmp

            Filesize

            64KB

          • memory/3356-955-0x000000000A760000-0x000000000A7C6000-memory.dmp

            Filesize

            408KB

          • memory/3356-956-0x000000000AE20000-0x000000000AEB2000-memory.dmp

            Filesize

            584KB

          • memory/3356-957-0x000000000AED0000-0x000000000AF20000-memory.dmp

            Filesize

            320KB

          • memory/3356-958-0x000000000AF40000-0x000000000AFB6000-memory.dmp

            Filesize

            472KB

          • memory/3356-959-0x000000000B0F0000-0x000000000B10E000-memory.dmp

            Filesize

            120KB

          • memory/3356-960-0x000000000B210000-0x000000000B3D2000-memory.dmp

            Filesize

            1.8MB

          • memory/3356-961-0x000000000B3E0000-0x000000000B90C000-memory.dmp

            Filesize

            5.2MB

          • memory/4132-968-0x0000000000D50000-0x0000000000D78000-memory.dmp

            Filesize

            160KB

          • memory/4132-969-0x0000000007B90000-0x0000000007BA0000-memory.dmp

            Filesize

            64KB

          • memory/4728-147-0x0000000000750000-0x000000000075A000-memory.dmp

            Filesize

            40KB