Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 23:48

General

  • Target

    a4a5526cc16090a8affba57f45b8249f4fe56e4740516a01727ce4b726b6fd91.exe

  • Size

    705KB

  • MD5

    5fc8f6358841599107e76ebb999835c6

  • SHA1

    e5f841720f287b9d785485622a48191ea2d629fc

  • SHA256

    a4a5526cc16090a8affba57f45b8249f4fe56e4740516a01727ce4b726b6fd91

  • SHA512

    6942e67a717b9cb97a031b29beeed74d74f1a6af0f080e2ca5ae0c3eedc11b720628a85fe7639bb3f2b8b688ac4c4e1c39328783ae170ce96aeaf806c2ef9bcc

  • SSDEEP

    12288:yy90uSKVUigjVQjxS2966racVXwpwx2Ts1o2I1DzCpbIzUMs9/a22Y5yjn:yyqHDijQAraUgpUUvYbIQH3Nyjn

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4a5526cc16090a8affba57f45b8249f4fe56e4740516a01727ce4b726b6fd91.exe
    "C:\Users\Admin\AppData\Local\Temp\a4a5526cc16090a8affba57f45b8249f4fe56e4740516a01727ce4b726b6fd91.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4380
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un983122.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un983122.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:976
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr706958.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr706958.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1080
          4⤵
          • Program crash
          PID:1568
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu819586.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu819586.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:208
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 1332
          4⤵
          • Program crash
          PID:5020
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si681441.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si681441.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1256
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4900 -ip 4900
    1⤵
      PID:3868
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 208 -ip 208
      1⤵
        PID:2340

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si681441.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si681441.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un983122.exe

              Filesize

              550KB

              MD5

              3be81ce88f6a9c4ffe517a5f65e39adc

              SHA1

              71875736aabc915d2c825a235bc800129b6081ac

              SHA256

              a95819f51d8fc78d9b77a0d4f381fc88a49f880d686811170f829f320d5c2255

              SHA512

              efc5d70d6eda0011505c79ca8c34a8cce54720eb20439043dc3d1e22423c8189338f87e97dd85894ee698cd81da9ae7ebc6da2ac63c6c42e0a910d02fe6336d4

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un983122.exe

              Filesize

              550KB

              MD5

              3be81ce88f6a9c4ffe517a5f65e39adc

              SHA1

              71875736aabc915d2c825a235bc800129b6081ac

              SHA256

              a95819f51d8fc78d9b77a0d4f381fc88a49f880d686811170f829f320d5c2255

              SHA512

              efc5d70d6eda0011505c79ca8c34a8cce54720eb20439043dc3d1e22423c8189338f87e97dd85894ee698cd81da9ae7ebc6da2ac63c6c42e0a910d02fe6336d4

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr706958.exe

              Filesize

              278KB

              MD5

              2f8c7d59cc0a2ec84dbf171649bc3833

              SHA1

              b055b8ec275ce24667d880260767c8367232cbf8

              SHA256

              7e624779da3da69eb95cba292654fd5d57da3218816de527ec941d08fffc70f1

              SHA512

              92e27b3684ff1ae2c2d0863770612fafed6bce55438f8add2e023fb41734ebefb957d4da3fb28a4afc8d05321050df6b8be785bb1f352b8c04771b30aac1ffe7

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr706958.exe

              Filesize

              278KB

              MD5

              2f8c7d59cc0a2ec84dbf171649bc3833

              SHA1

              b055b8ec275ce24667d880260767c8367232cbf8

              SHA256

              7e624779da3da69eb95cba292654fd5d57da3218816de527ec941d08fffc70f1

              SHA512

              92e27b3684ff1ae2c2d0863770612fafed6bce55438f8add2e023fb41734ebefb957d4da3fb28a4afc8d05321050df6b8be785bb1f352b8c04771b30aac1ffe7

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu819586.exe

              Filesize

              361KB

              MD5

              dc22d1adefe7a7ef4d8c057bf205fb8c

              SHA1

              507884738b64d92aa1c004f1fccd5805fedc8224

              SHA256

              7ff45208fe0115f4bf5951345075d7c7b734d9acc80f69d8688d3234521f7ecc

              SHA512

              e18f7db5dded1a73321a480924d017b1854ea7b7f464b1cb32dfeeaffa9008167f17b950b66b12790c070c87b1b156fa635a6bf8d4e2d17cb6a14f15e535626e

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu819586.exe

              Filesize

              361KB

              MD5

              dc22d1adefe7a7ef4d8c057bf205fb8c

              SHA1

              507884738b64d92aa1c004f1fccd5805fedc8224

              SHA256

              7ff45208fe0115f4bf5951345075d7c7b734d9acc80f69d8688d3234521f7ecc

              SHA512

              e18f7db5dded1a73321a480924d017b1854ea7b7f464b1cb32dfeeaffa9008167f17b950b66b12790c070c87b1b156fa635a6bf8d4e2d17cb6a14f15e535626e

            • memory/208-227-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-986-0x0000000009D10000-0x000000000A328000-memory.dmp

              Filesize

              6.1MB

            • memory/208-997-0x0000000006D10000-0x0000000006D60000-memory.dmp

              Filesize

              320KB

            • memory/208-996-0x000000000B990000-0x000000000B9AE000-memory.dmp

              Filesize

              120KB

            • memory/208-995-0x000000000B3E0000-0x000000000B90C000-memory.dmp

              Filesize

              5.2MB

            • memory/208-994-0x000000000B210000-0x000000000B3D2000-memory.dmp

              Filesize

              1.8MB

            • memory/208-993-0x000000000B130000-0x000000000B1A6000-memory.dmp

              Filesize

              472KB

            • memory/208-992-0x000000000AE20000-0x000000000AEB2000-memory.dmp

              Filesize

              584KB

            • memory/208-991-0x000000000A760000-0x000000000A7C6000-memory.dmp

              Filesize

              408KB

            • memory/208-990-0x00000000072D0000-0x00000000072E0000-memory.dmp

              Filesize

              64KB

            • memory/208-989-0x000000000A460000-0x000000000A49C000-memory.dmp

              Filesize

              240KB

            • memory/208-988-0x000000000A350000-0x000000000A45A000-memory.dmp

              Filesize

              1.0MB

            • memory/208-987-0x000000000A330000-0x000000000A342000-memory.dmp

              Filesize

              72KB

            • memory/208-225-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-223-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-221-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-219-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-217-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-215-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-213-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-208-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-211-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-190-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-191-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-193-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-195-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-197-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-199-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-201-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-204-0x00000000071F0000-0x0000000007225000-memory.dmp

              Filesize

              212KB

            • memory/208-205-0x00000000072D0000-0x00000000072E0000-memory.dmp

              Filesize

              64KB

            • memory/208-203-0x0000000002BD0000-0x0000000002C16000-memory.dmp

              Filesize

              280KB

            • memory/208-207-0x00000000072D0000-0x00000000072E0000-memory.dmp

              Filesize

              64KB

            • memory/208-209-0x00000000072D0000-0x00000000072E0000-memory.dmp

              Filesize

              64KB

            • memory/1256-1004-0x00000000000C0000-0x00000000000E8000-memory.dmp

              Filesize

              160KB

            • memory/1256-1005-0x0000000006E40000-0x0000000006E50000-memory.dmp

              Filesize

              64KB

            • memory/4900-173-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-177-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-183-0x00000000072C0000-0x00000000072D0000-memory.dmp

              Filesize

              64KB

            • memory/4900-182-0x00000000072C0000-0x00000000072D0000-memory.dmp

              Filesize

              64KB

            • memory/4900-180-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/4900-179-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-171-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-150-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-156-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-175-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-184-0x00000000072C0000-0x00000000072D0000-memory.dmp

              Filesize

              64KB

            • memory/4900-152-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-162-0x0000000002BB0000-0x0000000002BDD000-memory.dmp

              Filesize

              180KB

            • memory/4900-166-0x00000000072C0000-0x00000000072D0000-memory.dmp

              Filesize

              64KB

            • memory/4900-164-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-167-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-169-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-163-0x00000000072C0000-0x00000000072D0000-memory.dmp

              Filesize

              64KB

            • memory/4900-160-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-158-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-149-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB

            • memory/4900-148-0x00000000072D0000-0x0000000007874000-memory.dmp

              Filesize

              5.6MB

            • memory/4900-185-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/4900-154-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

              Filesize

              72KB