Analysis

  • max time kernel
    60s
  • max time network
    82s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 23:55

General

  • Target

    68cba62bf8a574604293cc1aec48a4414e7fe409deb433370f19fb640bc963da.exe

  • Size

    704KB

  • MD5

    9a37524a95a71955a7e824f6f8b868b7

  • SHA1

    dc1441fd0e0b8c8a04cb91e16cb9e5c45cbff53c

  • SHA256

    68cba62bf8a574604293cc1aec48a4414e7fe409deb433370f19fb640bc963da

  • SHA512

    37e88c017e223eb2a4515651b4c9230d9f373f8dc627d2e042e315c431b3bc105bd6053ad05014768ea22e3aab095f30f5a8714144db9855acdbf0d04a75cc60

  • SSDEEP

    12288:Xy90+8S0PlMqZHOxU2966rFdV0wK23GI15zClKIzJMvc/K8S6awuR/P:XyuSuRuGArFXFK23vBQKIt4IaHR/P

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68cba62bf8a574604293cc1aec48a4414e7fe409deb433370f19fb640bc963da.exe
    "C:\Users\Admin\AppData\Local\Temp\68cba62bf8a574604293cc1aec48a4414e7fe409deb433370f19fb640bc963da.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un796873.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un796873.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr742894.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr742894.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4208
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 1096
          4⤵
          • Program crash
          PID:4856
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu216446.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu216446.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4268
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 1324
          4⤵
          • Program crash
          PID:4856
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si203860.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si203860.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4768
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4208 -ip 4208
    1⤵
      PID:4944
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4268 -ip 4268
      1⤵
        PID:3680

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si203860.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si203860.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un796873.exe

              Filesize

              550KB

              MD5

              23c3841492808f34af61075697a52720

              SHA1

              cd3a2168785bf5d0840f1fcf747fcb2c3bcfb48b

              SHA256

              f9d07a65aea8fc1169b2b259fc798a05b2f516cb5fee3cb7404c33912725ff52

              SHA512

              2f12de2882acf0f872255ad8aaa4c9b37584e474215612b0259f138a880c620c5d98678e07dd8622fa8770b195aa515e7028ffab42c3805b12f0af66e3bc7346

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un796873.exe

              Filesize

              550KB

              MD5

              23c3841492808f34af61075697a52720

              SHA1

              cd3a2168785bf5d0840f1fcf747fcb2c3bcfb48b

              SHA256

              f9d07a65aea8fc1169b2b259fc798a05b2f516cb5fee3cb7404c33912725ff52

              SHA512

              2f12de2882acf0f872255ad8aaa4c9b37584e474215612b0259f138a880c620c5d98678e07dd8622fa8770b195aa515e7028ffab42c3805b12f0af66e3bc7346

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr742894.exe

              Filesize

              278KB

              MD5

              fdda9bb2d78bdb9e39696ec3e1d62e70

              SHA1

              35fb3fb311dd672a73ec43363b8c4d1ae1e64e6f

              SHA256

              8540456765fa1ab1bc01c7fadeb332f3ac47dcad6cd391288bb3d4eedab4511f

              SHA512

              0e8fea018b80b160548ce92dd27d1dc463f66cfd39900e8a596fa8fc966b8f1f500942f341d3d6fcfc969f811af30c1142238b565c2fa29408f97baf23de9f75

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr742894.exe

              Filesize

              278KB

              MD5

              fdda9bb2d78bdb9e39696ec3e1d62e70

              SHA1

              35fb3fb311dd672a73ec43363b8c4d1ae1e64e6f

              SHA256

              8540456765fa1ab1bc01c7fadeb332f3ac47dcad6cd391288bb3d4eedab4511f

              SHA512

              0e8fea018b80b160548ce92dd27d1dc463f66cfd39900e8a596fa8fc966b8f1f500942f341d3d6fcfc969f811af30c1142238b565c2fa29408f97baf23de9f75

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu216446.exe

              Filesize

              361KB

              MD5

              77c68fa4322227d8f24bdbd71455406a

              SHA1

              e02819914c0df8b2d9058efcc452e23ded5cfdb6

              SHA256

              b1f969aceade41735fed2bf30cc138b0b7ac912075300b08ef4fc4657b2beb79

              SHA512

              a331842994d107ce8e8281353b383bd02b7ec6eb7bb3b48e1f617f13c1181a22d843a2ba77ed83a24b290914c2e924cccacecf5e7ce40a95bb13493dbf592031

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu216446.exe

              Filesize

              361KB

              MD5

              77c68fa4322227d8f24bdbd71455406a

              SHA1

              e02819914c0df8b2d9058efcc452e23ded5cfdb6

              SHA256

              b1f969aceade41735fed2bf30cc138b0b7ac912075300b08ef4fc4657b2beb79

              SHA512

              a331842994d107ce8e8281353b383bd02b7ec6eb7bb3b48e1f617f13c1181a22d843a2ba77ed83a24b290914c2e924cccacecf5e7ce40a95bb13493dbf592031

            • memory/4208-148-0x0000000007190000-0x0000000007734000-memory.dmp

              Filesize

              5.6MB

            • memory/4208-149-0x0000000002BB0000-0x0000000002BDD000-memory.dmp

              Filesize

              180KB

            • memory/4208-150-0x0000000007180000-0x0000000007190000-memory.dmp

              Filesize

              64KB

            • memory/4208-151-0x0000000007180000-0x0000000007190000-memory.dmp

              Filesize

              64KB

            • memory/4208-152-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-153-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-155-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-157-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-159-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-161-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-163-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-165-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-167-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-169-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-171-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-173-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-175-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-177-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-179-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/4208-180-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/4208-181-0x0000000007180000-0x0000000007190000-memory.dmp

              Filesize

              64KB

            • memory/4208-182-0x0000000007180000-0x0000000007190000-memory.dmp

              Filesize

              64KB

            • memory/4208-183-0x0000000007180000-0x0000000007190000-memory.dmp

              Filesize

              64KB

            • memory/4208-185-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/4268-191-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-190-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-193-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-195-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-197-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-199-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-201-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-203-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-205-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-207-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-209-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-211-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-213-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-215-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-217-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-219-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-221-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-223-0x0000000004D60000-0x0000000004D95000-memory.dmp

              Filesize

              212KB

            • memory/4268-385-0x0000000002CA0000-0x0000000002CE6000-memory.dmp

              Filesize

              280KB

            • memory/4268-387-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

              Filesize

              64KB

            • memory/4268-388-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

              Filesize

              64KB

            • memory/4268-390-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

              Filesize

              64KB

            • memory/4268-986-0x0000000009C70000-0x000000000A288000-memory.dmp

              Filesize

              6.1MB

            • memory/4268-987-0x000000000A320000-0x000000000A332000-memory.dmp

              Filesize

              72KB

            • memory/4268-988-0x000000000A340000-0x000000000A44A000-memory.dmp

              Filesize

              1.0MB

            • memory/4268-989-0x000000000A460000-0x000000000A49C000-memory.dmp

              Filesize

              240KB

            • memory/4268-990-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

              Filesize

              64KB

            • memory/4268-991-0x000000000A760000-0x000000000A7C6000-memory.dmp

              Filesize

              408KB

            • memory/4268-992-0x000000000AE30000-0x000000000AEC2000-memory.dmp

              Filesize

              584KB

            • memory/4268-993-0x000000000B020000-0x000000000B070000-memory.dmp

              Filesize

              320KB

            • memory/4268-994-0x000000000B080000-0x000000000B0F6000-memory.dmp

              Filesize

              472KB

            • memory/4268-995-0x000000000B130000-0x000000000B14E000-memory.dmp

              Filesize

              120KB

            • memory/4268-996-0x000000000B350000-0x000000000B512000-memory.dmp

              Filesize

              1.8MB

            • memory/4268-997-0x000000000B520000-0x000000000BA4C000-memory.dmp

              Filesize

              5.2MB

            • memory/4768-1004-0x00000000007F0000-0x0000000000818000-memory.dmp

              Filesize

              160KB

            • memory/4768-1005-0x0000000007910000-0x0000000007920000-memory.dmp

              Filesize

              64KB