Analysis

  • max time kernel
    61s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 23:48

General

  • Target

    a9ccf55524ff8403a006ab4e5f0b4e3eb2334e28cd12e579bfa433c69d1be097.exe

  • Size

    564KB

  • MD5

    2f15f98cfb33dcccf0904d412ac3f3d1

  • SHA1

    576e06383b77ab6d6fba4ae5bd4290533be39c78

  • SHA256

    a9ccf55524ff8403a006ab4e5f0b4e3eb2334e28cd12e579bfa433c69d1be097

  • SHA512

    9bd554d6d91fce68d1e0387870e5a023f9fb3321b1a804017d5b2e57821299ee1124f299b2f771adbfa005745e0afb8f3f859c81caed82df521314a13721e2b9

  • SSDEEP

    12288:sy90EBWvnTrYYFbANUxOgWIkaz+0/lzFMFV99SLZC:sy5BKnTrYY0Ux1ySJ/lZCj90ZC

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9ccf55524ff8403a006ab4e5f0b4e3eb2334e28cd12e579bfa433c69d1be097.exe
    "C:\Users\Admin\AppData\Local\Temp\a9ccf55524ff8403a006ab4e5f0b4e3eb2334e28cd12e579bfa433c69d1be097.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIk2912.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIk2912.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4136
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it246830.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it246830.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4736
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp042659.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp042659.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4632
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 1828
          4⤵
          • Program crash
          PID:4700
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr484900.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr484900.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4276
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4632 -ip 4632
    1⤵
      PID:3516

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr484900.exe

            Filesize

            136KB

            MD5

            ace73b2b1f835de11594ea9a243a9f5c

            SHA1

            2f929d1f69784fbe499a95b064679a16947bdd84

            SHA256

            7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

            SHA512

            024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr484900.exe

            Filesize

            136KB

            MD5

            ace73b2b1f835de11594ea9a243a9f5c

            SHA1

            2f929d1f69784fbe499a95b064679a16947bdd84

            SHA256

            7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

            SHA512

            024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIk2912.exe

            Filesize

            409KB

            MD5

            58475b69c69d1b9bb9d091de311605c4

            SHA1

            07a6b6018f7429e13130b9020c952368bb18dfe3

            SHA256

            45492004f1c15f5952529d2b0353503772446e6232d20da91d8b7c54f671d7ca

            SHA512

            1836e91170fb3cdbe693fba55969513415cfc987cb9875d554194014d61aea6fdcfe8b265ea30cf6ee884491d6f31e33a515e8de246f526bf4ee4e67c5e50876

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIk2912.exe

            Filesize

            409KB

            MD5

            58475b69c69d1b9bb9d091de311605c4

            SHA1

            07a6b6018f7429e13130b9020c952368bb18dfe3

            SHA256

            45492004f1c15f5952529d2b0353503772446e6232d20da91d8b7c54f671d7ca

            SHA512

            1836e91170fb3cdbe693fba55969513415cfc987cb9875d554194014d61aea6fdcfe8b265ea30cf6ee884491d6f31e33a515e8de246f526bf4ee4e67c5e50876

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it246830.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it246830.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp042659.exe

            Filesize

            361KB

            MD5

            7fee7913d19ca16799cc9712bff39f21

            SHA1

            a972d7ebfc41efd33bfbe2ccb8c71fcfe7a2d125

            SHA256

            f63afc2734822a357b3f29c58ffe137e1148dfd5089698ede15a318ddb1343e1

            SHA512

            dd2b74792d777cb13f792c8146f1e092b8a9f03e6fa64fabf43ad0145edf83608bdf0203821a6b3cfc1f9639a28434a39cc8030b5a90c9f7ffc36d570e3e8376

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp042659.exe

            Filesize

            361KB

            MD5

            7fee7913d19ca16799cc9712bff39f21

            SHA1

            a972d7ebfc41efd33bfbe2ccb8c71fcfe7a2d125

            SHA256

            f63afc2734822a357b3f29c58ffe137e1148dfd5089698ede15a318ddb1343e1

            SHA512

            dd2b74792d777cb13f792c8146f1e092b8a9f03e6fa64fabf43ad0145edf83608bdf0203821a6b3cfc1f9639a28434a39cc8030b5a90c9f7ffc36d570e3e8376

          • memory/4276-968-0x00000000005D0000-0x00000000005F8000-memory.dmp

            Filesize

            160KB

          • memory/4276-969-0x0000000007690000-0x00000000076A0000-memory.dmp

            Filesize

            64KB

          • memory/4632-187-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-197-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-155-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-156-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-158-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-160-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-162-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-164-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-166-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-168-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-170-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-172-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-174-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-175-0x00000000071A0000-0x00000000071B0000-memory.dmp

            Filesize

            64KB

          • memory/4632-177-0x00000000071A0000-0x00000000071B0000-memory.dmp

            Filesize

            64KB

          • memory/4632-178-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-179-0x00000000071A0000-0x00000000071B0000-memory.dmp

            Filesize

            64KB

          • memory/4632-181-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-183-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-185-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-153-0x0000000002CE0000-0x0000000002D26000-memory.dmp

            Filesize

            280KB

          • memory/4632-189-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-191-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-193-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-195-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-154-0x00000000071B0000-0x0000000007754000-memory.dmp

            Filesize

            5.6MB

          • memory/4632-199-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-201-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-203-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-205-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-207-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-209-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-211-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-213-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-215-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-217-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-219-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-221-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/4632-950-0x0000000009C60000-0x000000000A278000-memory.dmp

            Filesize

            6.1MB

          • memory/4632-951-0x000000000A320000-0x000000000A332000-memory.dmp

            Filesize

            72KB

          • memory/4632-952-0x000000000A340000-0x000000000A44A000-memory.dmp

            Filesize

            1.0MB

          • memory/4632-953-0x00000000071A0000-0x00000000071B0000-memory.dmp

            Filesize

            64KB

          • memory/4632-954-0x000000000A4A0000-0x000000000A4DC000-memory.dmp

            Filesize

            240KB

          • memory/4632-955-0x000000000A760000-0x000000000A7C6000-memory.dmp

            Filesize

            408KB

          • memory/4632-956-0x000000000AE20000-0x000000000AEB2000-memory.dmp

            Filesize

            584KB

          • memory/4632-957-0x000000000AFF0000-0x000000000B066000-memory.dmp

            Filesize

            472KB

          • memory/4632-958-0x000000000B090000-0x000000000B0AE000-memory.dmp

            Filesize

            120KB

          • memory/4632-959-0x000000000B1B0000-0x000000000B372000-memory.dmp

            Filesize

            1.8MB

          • memory/4632-960-0x000000000B380000-0x000000000B8AC000-memory.dmp

            Filesize

            5.2MB

          • memory/4632-961-0x0000000004870000-0x00000000048C0000-memory.dmp

            Filesize

            320KB

          • memory/4736-147-0x00000000007D0000-0x00000000007DA000-memory.dmp

            Filesize

            40KB