Analysis

  • max time kernel
    54s
  • max time network
    71s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/04/2023, 23:50

General

  • Target

    074530f56e76ca5cecc69ae25ee1236b382b323392a71307f34e66340880bf3e.exe

  • Size

    703KB

  • MD5

    ceaf0ce3b0036d2e17a179a1eec7ddc0

  • SHA1

    40367912bcfce0c977206a4070a79910e4703d31

  • SHA256

    074530f56e76ca5cecc69ae25ee1236b382b323392a71307f34e66340880bf3e

  • SHA512

    ea608b1108c33702c55342c005e7b5d200eb37e961159ac6476c0278a5f9ac2ecedfefec496e72715770948d556a1d0ccf15c1dd0f38305f1886c4885043c592

  • SSDEEP

    12288:Zy90+2YJFXNbwRip07UYqLTec2VKtWI1zzC9MIznMqo/KbdtdGT:ZyXBw1UpL0KZ/MMIDp7dHGT

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\074530f56e76ca5cecc69ae25ee1236b382b323392a71307f34e66340880bf3e.exe
    "C:\Users\Admin\AppData\Local\Temp\074530f56e76ca5cecc69ae25ee1236b382b323392a71307f34e66340880bf3e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un363612.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un363612.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3372
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr315516.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr315516.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4168
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu134620.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu134620.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3160
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si142239.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si142239.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3780

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si142239.exe

          Filesize

          136KB

          MD5

          ace73b2b1f835de11594ea9a243a9f5c

          SHA1

          2f929d1f69784fbe499a95b064679a16947bdd84

          SHA256

          7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

          SHA512

          024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si142239.exe

          Filesize

          136KB

          MD5

          ace73b2b1f835de11594ea9a243a9f5c

          SHA1

          2f929d1f69784fbe499a95b064679a16947bdd84

          SHA256

          7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

          SHA512

          024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un363612.exe

          Filesize

          549KB

          MD5

          592280f75e4c1d6252c30fcd978b428b

          SHA1

          6590d2b253f55789079e2fcfedb2d2d0cf8ed919

          SHA256

          35009834caa4936e938a0af163004a50ff15edf06d722a06c5429526f4349351

          SHA512

          564eb8a927c6486ec0125900cc1b7d0eee27d3df31e7a779ee176d1588e527a018cc15de92831a9941ff0494624e907ec09bdb2a0c91289bc709c6a222900e29

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un363612.exe

          Filesize

          549KB

          MD5

          592280f75e4c1d6252c30fcd978b428b

          SHA1

          6590d2b253f55789079e2fcfedb2d2d0cf8ed919

          SHA256

          35009834caa4936e938a0af163004a50ff15edf06d722a06c5429526f4349351

          SHA512

          564eb8a927c6486ec0125900cc1b7d0eee27d3df31e7a779ee176d1588e527a018cc15de92831a9941ff0494624e907ec09bdb2a0c91289bc709c6a222900e29

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr315516.exe

          Filesize

          278KB

          MD5

          ea129ae4e2eec913a0abb8a1860e383d

          SHA1

          cc11444a5348d0948ccfb353ddfc0199d4f79897

          SHA256

          faecfb7874997a37e0096fe2b4434fbc333d96797b6fa70b69b9d260365dc752

          SHA512

          88f2adbffa90bd21186c8818dab9e74884d401d7364c8c520e7884620ca9e24a403a1ca1f73c9d7ea2adbb33b0c3baf0fe6d35d8e134e2326449b06ba24d012a

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr315516.exe

          Filesize

          278KB

          MD5

          ea129ae4e2eec913a0abb8a1860e383d

          SHA1

          cc11444a5348d0948ccfb353ddfc0199d4f79897

          SHA256

          faecfb7874997a37e0096fe2b4434fbc333d96797b6fa70b69b9d260365dc752

          SHA512

          88f2adbffa90bd21186c8818dab9e74884d401d7364c8c520e7884620ca9e24a403a1ca1f73c9d7ea2adbb33b0c3baf0fe6d35d8e134e2326449b06ba24d012a

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu134620.exe

          Filesize

          361KB

          MD5

          dbd9429a188264660be8c2063838216e

          SHA1

          0755dfb277703fc264026eedffa4d6ce2f211536

          SHA256

          4fd3dfa285930f483efcc8694bbc41d006321540f053ff7b42a14d96ddd567a9

          SHA512

          60aabab3d8fc5e7833c6f4317d5f10aa8435743ec42411bed0c6911d28eb499a39cd9a674d0b23689d84922c0e473020043be28e9fc22d70af24285c8cc7e513

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu134620.exe

          Filesize

          361KB

          MD5

          dbd9429a188264660be8c2063838216e

          SHA1

          0755dfb277703fc264026eedffa4d6ce2f211536

          SHA256

          4fd3dfa285930f483efcc8694bbc41d006321540f053ff7b42a14d96ddd567a9

          SHA512

          60aabab3d8fc5e7833c6f4317d5f10aa8435743ec42411bed0c6911d28eb499a39cd9a674d0b23689d84922c0e473020043be28e9fc22d70af24285c8cc7e513

        • memory/3160-216-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-978-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/3160-182-0x0000000002CE0000-0x0000000002D26000-memory.dmp

          Filesize

          280KB

        • memory/3160-989-0x000000000B280000-0x000000000B7AC000-memory.dmp

          Filesize

          5.2MB

        • memory/3160-988-0x000000000B0B0000-0x000000000B272000-memory.dmp

          Filesize

          1.8MB

        • memory/3160-987-0x000000000AFE0000-0x000000000AFFE000-memory.dmp

          Filesize

          120KB

        • memory/3160-986-0x000000000AE40000-0x000000000AEB6000-memory.dmp

          Filesize

          472KB

        • memory/3160-985-0x000000000ADD0000-0x000000000AE20000-memory.dmp

          Filesize

          320KB

        • memory/3160-984-0x000000000AD30000-0x000000000ADC2000-memory.dmp

          Filesize

          584KB

        • memory/3160-983-0x000000000A060000-0x000000000A0C6000-memory.dmp

          Filesize

          408KB

        • memory/3160-982-0x0000000009ED0000-0x0000000009F1B000-memory.dmp

          Filesize

          300KB

        • memory/3160-981-0x0000000009D50000-0x0000000009D8E000-memory.dmp

          Filesize

          248KB

        • memory/3160-980-0x0000000007160000-0x0000000007170000-memory.dmp

          Filesize

          64KB

        • memory/3160-979-0x0000000009C30000-0x0000000009D3A000-memory.dmp

          Filesize

          1.0MB

        • memory/3160-977-0x000000000A200000-0x000000000A806000-memory.dmp

          Filesize

          6.0MB

        • memory/3160-218-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-214-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-212-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-210-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-208-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-181-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-204-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-202-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-200-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-179-0x0000000004BA0000-0x0000000004BDC000-memory.dmp

          Filesize

          240KB

        • memory/3160-180-0x00000000070B0000-0x00000000070EA000-memory.dmp

          Filesize

          232KB

        • memory/3160-184-0x0000000007160000-0x0000000007170000-memory.dmp

          Filesize

          64KB

        • memory/3160-183-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-186-0x0000000007160000-0x0000000007170000-memory.dmp

          Filesize

          64KB

        • memory/3160-188-0x0000000007160000-0x0000000007170000-memory.dmp

          Filesize

          64KB

        • memory/3160-190-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-187-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-198-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-192-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-206-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-194-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3160-196-0x00000000070B0000-0x00000000070E5000-memory.dmp

          Filesize

          212KB

        • memory/3780-995-0x0000000000C10000-0x0000000000C38000-memory.dmp

          Filesize

          160KB

        • memory/3780-997-0x0000000007D20000-0x0000000007D30000-memory.dmp

          Filesize

          64KB

        • memory/3780-996-0x0000000007990000-0x00000000079DB000-memory.dmp

          Filesize

          300KB

        • memory/4168-151-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-157-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-171-0x0000000004C30000-0x0000000004C40000-memory.dmp

          Filesize

          64KB

        • memory/4168-170-0x0000000000400000-0x0000000002BAF000-memory.dmp

          Filesize

          39.7MB

        • memory/4168-168-0x0000000004C30000-0x0000000004C40000-memory.dmp

          Filesize

          64KB

        • memory/4168-169-0x0000000004C30000-0x0000000004C40000-memory.dmp

          Filesize

          64KB

        • memory/4168-137-0x0000000004C30000-0x0000000004C40000-memory.dmp

          Filesize

          64KB

        • memory/4168-167-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-165-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-140-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-141-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-163-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-147-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-173-0x0000000000400000-0x0000000002BAF000-memory.dmp

          Filesize

          39.7MB

        • memory/4168-155-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-153-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-161-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-149-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-159-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-145-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-143-0x00000000075F0000-0x0000000007602000-memory.dmp

          Filesize

          72KB

        • memory/4168-135-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

          Filesize

          180KB

        • memory/4168-136-0x0000000004BF0000-0x0000000004C0A000-memory.dmp

          Filesize

          104KB

        • memory/4168-174-0x0000000004C30000-0x0000000004C40000-memory.dmp

          Filesize

          64KB

        • memory/4168-139-0x00000000075F0000-0x0000000007608000-memory.dmp

          Filesize

          96KB

        • memory/4168-138-0x00000000070B0000-0x00000000075AE000-memory.dmp

          Filesize

          5.0MB