Analysis

  • max time kernel
    60s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 23:51

General

  • Target

    9e51f9834bfc8268528230a7a40ffe292ac3a08ac2149273db3fa51c22661c8d.exe

  • Size

    704KB

  • MD5

    840bf079aad54aef64f647f66871d572

  • SHA1

    0c59bd5ea32dacbe2eff5816f081c5a15c0fb70c

  • SHA256

    9e51f9834bfc8268528230a7a40ffe292ac3a08ac2149273db3fa51c22661c8d

  • SHA512

    944eb40a509313c5ca3586c5e5636cd3340289ffccf73ef22d157c6fca372c7120097e8ffd5eeeb882a99cb91f47c96dbf749a62d654790a7bbbebea3de1bdce

  • SSDEEP

    12288:Ay904HrYo51T2E827CnJ+sx7ittI1HzCBKIznM1O/Kcc+e1d:AyBHrX51T827CJnx7iyTwKITqdd

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e51f9834bfc8268528230a7a40ffe292ac3a08ac2149273db3fa51c22661c8d.exe
    "C:\Users\Admin\AppData\Local\Temp\9e51f9834bfc8268528230a7a40ffe292ac3a08ac2149273db3fa51c22661c8d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un205020.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un205020.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr738755.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr738755.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4208
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 1080
          4⤵
          • Program crash
          PID:3532
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868364.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868364.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4628
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 1340
          4⤵
          • Program crash
          PID:4032
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si330234.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si330234.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1500
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4208 -ip 4208
    1⤵
      PID:4332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4628 -ip 4628
      1⤵
        PID:988

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si330234.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si330234.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un205020.exe

              Filesize

              549KB

              MD5

              82ec6afdd501c9a3c905a8898780e346

              SHA1

              aaff301fc96ab46ee46e83a15a3b3b272cdc942a

              SHA256

              7e78e6c2ac3add67b6ba629bc39da526e12cd5c4425b4e66282b71636074028c

              SHA512

              0589875ab791438dfcea223d03b287a8fc81809ed87805e1fc56a050d9380e040db6624e17e978aecb33b88b90fb54f0c89f2b7ebf3333a193297298e7c79960

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un205020.exe

              Filesize

              549KB

              MD5

              82ec6afdd501c9a3c905a8898780e346

              SHA1

              aaff301fc96ab46ee46e83a15a3b3b272cdc942a

              SHA256

              7e78e6c2ac3add67b6ba629bc39da526e12cd5c4425b4e66282b71636074028c

              SHA512

              0589875ab791438dfcea223d03b287a8fc81809ed87805e1fc56a050d9380e040db6624e17e978aecb33b88b90fb54f0c89f2b7ebf3333a193297298e7c79960

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr738755.exe

              Filesize

              278KB

              MD5

              f044fcaeb9896ee1fdb250673ffd63e6

              SHA1

              5955d1441c9160a49e37cf27f0db01490cef87b6

              SHA256

              681980a7ad175640cdbbe69864de16b1bef0645f13e67451548d51a64540bdbe

              SHA512

              623200c0c4e5045bfbee376a2e79c92ed988f98c6bac84be0e5799fc981272cbf4460daf8c3c3f854ff2849fb2af1b44ea4a58e7f4bf2a782e3e33ca76b87b8a

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr738755.exe

              Filesize

              278KB

              MD5

              f044fcaeb9896ee1fdb250673ffd63e6

              SHA1

              5955d1441c9160a49e37cf27f0db01490cef87b6

              SHA256

              681980a7ad175640cdbbe69864de16b1bef0645f13e67451548d51a64540bdbe

              SHA512

              623200c0c4e5045bfbee376a2e79c92ed988f98c6bac84be0e5799fc981272cbf4460daf8c3c3f854ff2849fb2af1b44ea4a58e7f4bf2a782e3e33ca76b87b8a

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868364.exe

              Filesize

              361KB

              MD5

              2c02b728f5fb060ee8a6fd76046e45cd

              SHA1

              998885f23a9539a6c71b43255267f6ce1194819a

              SHA256

              d00ba9249944a9e3633b03dfcc9ccf5852d0b8c47f9c25b894cdf88152ba1d9d

              SHA512

              51de1081544044d3f6ffc97146ce2ed47c637087c8f391edcdc03ee7dd1850027cff0c3c23bd7b032c6e89bc2e8cfc8a2f8d2e1a5a3f2ff21075ad0c6226bbde

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868364.exe

              Filesize

              361KB

              MD5

              2c02b728f5fb060ee8a6fd76046e45cd

              SHA1

              998885f23a9539a6c71b43255267f6ce1194819a

              SHA256

              d00ba9249944a9e3633b03dfcc9ccf5852d0b8c47f9c25b894cdf88152ba1d9d

              SHA512

              51de1081544044d3f6ffc97146ce2ed47c637087c8f391edcdc03ee7dd1850027cff0c3c23bd7b032c6e89bc2e8cfc8a2f8d2e1a5a3f2ff21075ad0c6226bbde

            • memory/1500-1002-0x00000000009D0000-0x00000000009F8000-memory.dmp

              Filesize

              160KB

            • memory/1500-1003-0x0000000007A60000-0x0000000007A70000-memory.dmp

              Filesize

              64KB

            • memory/4208-157-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-167-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-151-0x00000000073F0000-0x0000000007400000-memory.dmp

              Filesize

              64KB

            • memory/4208-152-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-155-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-153-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-149-0x0000000002C80000-0x0000000002CAD000-memory.dmp

              Filesize

              180KB

            • memory/4208-159-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-161-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-163-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-165-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-150-0x00000000073F0000-0x0000000007400000-memory.dmp

              Filesize

              64KB

            • memory/4208-169-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-171-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-173-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-175-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-177-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-179-0x0000000004F00000-0x0000000004F12000-memory.dmp

              Filesize

              72KB

            • memory/4208-180-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/4208-181-0x00000000073F0000-0x0000000007400000-memory.dmp

              Filesize

              64KB

            • memory/4208-183-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/4208-148-0x0000000007400000-0x00000000079A4000-memory.dmp

              Filesize

              5.6MB

            • memory/4628-189-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-219-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-190-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-195-0x0000000007200000-0x0000000007210000-memory.dmp

              Filesize

              64KB

            • memory/4628-194-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-192-0x0000000007200000-0x0000000007210000-memory.dmp

              Filesize

              64KB

            • memory/4628-197-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-199-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-201-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-203-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-205-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-207-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-209-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-211-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-213-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-215-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-217-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-191-0x0000000007200000-0x0000000007210000-memory.dmp

              Filesize

              64KB

            • memory/4628-221-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-223-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-225-0x0000000007190000-0x00000000071C5000-memory.dmp

              Filesize

              212KB

            • memory/4628-984-0x0000000009C80000-0x000000000A298000-memory.dmp

              Filesize

              6.1MB

            • memory/4628-985-0x000000000A320000-0x000000000A332000-memory.dmp

              Filesize

              72KB

            • memory/4628-986-0x000000000A340000-0x000000000A44A000-memory.dmp

              Filesize

              1.0MB

            • memory/4628-987-0x000000000A460000-0x000000000A49C000-memory.dmp

              Filesize

              240KB

            • memory/4628-988-0x0000000007200000-0x0000000007210000-memory.dmp

              Filesize

              64KB

            • memory/4628-989-0x000000000A760000-0x000000000A7C6000-memory.dmp

              Filesize

              408KB

            • memory/4628-990-0x000000000AE20000-0x000000000AEB2000-memory.dmp

              Filesize

              584KB

            • memory/4628-991-0x000000000AFF0000-0x000000000B066000-memory.dmp

              Filesize

              472KB

            • memory/4628-992-0x000000000B0D0000-0x000000000B292000-memory.dmp

              Filesize

              1.8MB

            • memory/4628-188-0x0000000002CE0000-0x0000000002D26000-memory.dmp

              Filesize

              280KB

            • memory/4628-993-0x000000000B2A0000-0x000000000B7CC000-memory.dmp

              Filesize

              5.2MB

            • memory/4628-995-0x000000000B8E0000-0x000000000B8FE000-memory.dmp

              Filesize

              120KB

            • memory/4628-996-0x0000000006B50000-0x0000000006BA0000-memory.dmp

              Filesize

              320KB