Analysis

  • max time kernel
    94s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 23:47

General

  • Target

    807542b137786f75312f642ff1f048b64c478e83b97e40d83de47e9b16e1134b.exe

  • Size

    704KB

  • MD5

    4e5c4c7e5ecc20415b9b605d56349598

  • SHA1

    5ccea2f35ed29297e46e3272ec3d15c9bd179e47

  • SHA256

    807542b137786f75312f642ff1f048b64c478e83b97e40d83de47e9b16e1134b

  • SHA512

    ca0b7d84d265fe38cf34c66fb98a1d094d834f24dfde392fbd4b8e90d115fee4c435fc30472427aef9661f2ae83285b747ba182e660aebcb0c47d562cd275507

  • SSDEEP

    12288:Dy90WMIqFpjWjwCNTP/nOLmt9I1fzCV3Iz/MzE/KOWFWVRYyi7aVDKe:DyzM/Fpj9CNJirM3ILc6WqRYhGH

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\807542b137786f75312f642ff1f048b64c478e83b97e40d83de47e9b16e1134b.exe
    "C:\Users\Admin\AppData\Local\Temp\807542b137786f75312f642ff1f048b64c478e83b97e40d83de47e9b16e1134b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un738542.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un738542.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr899008.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr899008.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1268
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1080
          4⤵
          • Program crash
          PID:672
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu471212.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu471212.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3464
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 1320
          4⤵
          • Program crash
          PID:628
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si223809.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si223809.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1276
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1268 -ip 1268
    1⤵
      PID:1064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3464 -ip 3464
      1⤵
        PID:4764

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si223809.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si223809.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un738542.exe

              Filesize

              549KB

              MD5

              b74750e9084adc7884f7304df8b15d20

              SHA1

              c57ae2a9e93608ee65a000cb4e0c2a2172fabc70

              SHA256

              0ffba035cd26f30e8b71a330b0da477a6526f155b1c460688804d7cf2e0be8e9

              SHA512

              2f4531ac20cf2e4459bd78554187c49d93056a47fb381b42f6f03c501f7cb00073a620cc6d0840e40855cb97327767716f257afba9627d22eaa8882a54bc4a76

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un738542.exe

              Filesize

              549KB

              MD5

              b74750e9084adc7884f7304df8b15d20

              SHA1

              c57ae2a9e93608ee65a000cb4e0c2a2172fabc70

              SHA256

              0ffba035cd26f30e8b71a330b0da477a6526f155b1c460688804d7cf2e0be8e9

              SHA512

              2f4531ac20cf2e4459bd78554187c49d93056a47fb381b42f6f03c501f7cb00073a620cc6d0840e40855cb97327767716f257afba9627d22eaa8882a54bc4a76

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr899008.exe

              Filesize

              278KB

              MD5

              9ef4579c9527618f89e8c8de82e28d70

              SHA1

              48c665c23a1fdb26161842052dd68db3addf72a7

              SHA256

              5c55f1df6f762549604af43b410b5730237c351abb472ec50e2d9936d089f963

              SHA512

              514f6d06976ffaceaf0d721c6a5a36438f5a07adbd281932b927fa7a28b5045311f1d796c8f9f8b1e3e3375e24e694e50f0c6483a76259939ef44355242bd88e

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr899008.exe

              Filesize

              278KB

              MD5

              9ef4579c9527618f89e8c8de82e28d70

              SHA1

              48c665c23a1fdb26161842052dd68db3addf72a7

              SHA256

              5c55f1df6f762549604af43b410b5730237c351abb472ec50e2d9936d089f963

              SHA512

              514f6d06976ffaceaf0d721c6a5a36438f5a07adbd281932b927fa7a28b5045311f1d796c8f9f8b1e3e3375e24e694e50f0c6483a76259939ef44355242bd88e

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu471212.exe

              Filesize

              361KB

              MD5

              076f4677dd24df96aef54eeaed0da32e

              SHA1

              7f46ff64c3d2960404f9e22ea3e23731a92aa818

              SHA256

              08422937c0c081d8eee0b4c7a47eb318219382804a1a4aa2cd1ffd3da126cad3

              SHA512

              99f908daa0cd00dd243c147003bf42713d75f9de6ff33e211326ab1d634c4a58bf08829e4bb59601ac86009b11aaf9a03b9e3bea1df809ed32c4dcd448bacf16

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu471212.exe

              Filesize

              361KB

              MD5

              076f4677dd24df96aef54eeaed0da32e

              SHA1

              7f46ff64c3d2960404f9e22ea3e23731a92aa818

              SHA256

              08422937c0c081d8eee0b4c7a47eb318219382804a1a4aa2cd1ffd3da126cad3

              SHA512

              99f908daa0cd00dd243c147003bf42713d75f9de6ff33e211326ab1d634c4a58bf08829e4bb59601ac86009b11aaf9a03b9e3bea1df809ed32c4dcd448bacf16

            • memory/1268-154-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-168-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-150-0x0000000007300000-0x0000000007310000-memory.dmp

              Filesize

              64KB

            • memory/1268-151-0x0000000007300000-0x0000000007310000-memory.dmp

              Filesize

              64KB

            • memory/1268-152-0x0000000007300000-0x0000000007310000-memory.dmp

              Filesize

              64KB

            • memory/1268-153-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-158-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-156-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-148-0x0000000002DA0000-0x0000000002DCD000-memory.dmp

              Filesize

              180KB

            • memory/1268-160-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-162-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-164-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-166-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-149-0x0000000007310000-0x00000000078B4000-memory.dmp

              Filesize

              5.6MB

            • memory/1268-174-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-172-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-176-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-170-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-178-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-180-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

              Filesize

              72KB

            • memory/1268-181-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/1268-184-0x0000000007300000-0x0000000007310000-memory.dmp

              Filesize

              64KB

            • memory/1268-183-0x0000000007300000-0x0000000007310000-memory.dmp

              Filesize

              64KB

            • memory/1268-185-0x0000000007300000-0x0000000007310000-memory.dmp

              Filesize

              64KB

            • memory/1268-186-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/1276-1005-0x0000000000490000-0x00000000004B8000-memory.dmp

              Filesize

              160KB

            • memory/1276-1006-0x00000000075C0000-0x00000000075D0000-memory.dmp

              Filesize

              64KB

            • memory/3464-191-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-194-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-196-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-198-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-200-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-202-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-204-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-206-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-208-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-210-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-212-0x0000000002CA0000-0x0000000002CE6000-memory.dmp

              Filesize

              280KB

            • memory/3464-215-0x0000000007370000-0x0000000007380000-memory.dmp

              Filesize

              64KB

            • memory/3464-216-0x0000000007370000-0x0000000007380000-memory.dmp

              Filesize

              64KB

            • memory/3464-214-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-213-0x0000000007370000-0x0000000007380000-memory.dmp

              Filesize

              64KB

            • memory/3464-218-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-220-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-222-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-228-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-226-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-224-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-987-0x0000000009CB0000-0x000000000A2C8000-memory.dmp

              Filesize

              6.1MB

            • memory/3464-988-0x000000000A320000-0x000000000A332000-memory.dmp

              Filesize

              72KB

            • memory/3464-989-0x000000000A340000-0x000000000A44A000-memory.dmp

              Filesize

              1.0MB

            • memory/3464-990-0x000000000A460000-0x000000000A49C000-memory.dmp

              Filesize

              240KB

            • memory/3464-991-0x0000000007370000-0x0000000007380000-memory.dmp

              Filesize

              64KB

            • memory/3464-992-0x000000000A760000-0x000000000A7C6000-memory.dmp

              Filesize

              408KB

            • memory/3464-993-0x000000000AE30000-0x000000000AEC2000-memory.dmp

              Filesize

              584KB

            • memory/3464-994-0x000000000AFE0000-0x000000000B030000-memory.dmp

              Filesize

              320KB

            • memory/3464-995-0x000000000B040000-0x000000000B0B6000-memory.dmp

              Filesize

              472KB

            • memory/3464-192-0x00000000071E0000-0x0000000007215000-memory.dmp

              Filesize

              212KB

            • memory/3464-996-0x000000000B150000-0x000000000B312000-memory.dmp

              Filesize

              1.8MB

            • memory/3464-997-0x000000000B320000-0x000000000B84C000-memory.dmp

              Filesize

              5.2MB

            • memory/3464-998-0x000000000BA70000-0x000000000BA8E000-memory.dmp

              Filesize

              120KB