Analysis

  • max time kernel
    114s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 23:56

General

  • Target

    bbe57660dae3dc21311d8711f28a8ebebe5b1878c61fcc6b610ebba086a14ce8.exe

  • Size

    737KB

  • MD5

    04019b30bd51085b1e9b4ba47e469049

  • SHA1

    b13e9290ae2e839da7232fab28a9ecf685f5e479

  • SHA256

    bbe57660dae3dc21311d8711f28a8ebebe5b1878c61fcc6b610ebba086a14ce8

  • SHA512

    996d02e2f1236456758d22e0ec6b69c4b05f6c17dae244a13aa5d63d4c9797e2d80acb096fb49394fac97bbf27ac701d19b208e2e6b704f01b10771e731e2e79

  • SSDEEP

    12288:fy90EqokgexlmqLszb9T5O+oQIFNK8ntAXW5DI17zC0xIznWPYImhT:fyhwP3mqLq5cdFA8+WAn9xIjaYIaT

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bbe57660dae3dc21311d8711f28a8ebebe5b1878c61fcc6b610ebba086a14ce8.exe
    "C:\Users\Admin\AppData\Local\Temp\bbe57660dae3dc21311d8711f28a8ebebe5b1878c61fcc6b610ebba086a14ce8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un751405.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un751405.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18845640.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18845640.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3692
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr419578.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr419578.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:988
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 1088
          4⤵
          • Program crash
          PID:3352
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu279112.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu279112.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1956
        3⤵
        • Program crash
        PID:3728
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 988 -ip 988
    1⤵
      PID:5100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1740 -ip 1740
      1⤵
        PID:4048

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu279112.exe

              Filesize

              361KB

              MD5

              d6c93a35e3df5f1c7142e88e67e5557e

              SHA1

              5cdab3d894ce6d6966603de2fde1be9bae438593

              SHA256

              6ee570e0738a36142496c6b27dd66f8986b413961da7093f82d095fe636759a8

              SHA512

              370e757a3d92dbd60d1bdd2b0d67b7bd8f27d16addc9d465864c2857bcb804de911f89e6c2ed8bf21916ff296acd318f6a2d227d56f8b9e45d3a80f8affeb3ef

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu279112.exe

              Filesize

              361KB

              MD5

              d6c93a35e3df5f1c7142e88e67e5557e

              SHA1

              5cdab3d894ce6d6966603de2fde1be9bae438593

              SHA256

              6ee570e0738a36142496c6b27dd66f8986b413961da7093f82d095fe636759a8

              SHA512

              370e757a3d92dbd60d1bdd2b0d67b7bd8f27d16addc9d465864c2857bcb804de911f89e6c2ed8bf21916ff296acd318f6a2d227d56f8b9e45d3a80f8affeb3ef

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un751405.exe

              Filesize

              380KB

              MD5

              2de59ca0f50cbc460923e6626754b8ee

              SHA1

              4e217d61ef0975ce359aa9ec461429b5e8e4d71d

              SHA256

              7e5896cebbebf4fd6df21cead501486c2cd925e9c1a3983e61fe17a6d8e2367a

              SHA512

              7af3a7ffd41837a4c368f7ccd4bb02ea2db1ad1cc3d971bcf693cef3d6ca56046f47fc7209bfe675ead6793cdfd628d8b1464e074e0cb06b4b0fa4c3c446744f

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un751405.exe

              Filesize

              380KB

              MD5

              2de59ca0f50cbc460923e6626754b8ee

              SHA1

              4e217d61ef0975ce359aa9ec461429b5e8e4d71d

              SHA256

              7e5896cebbebf4fd6df21cead501486c2cd925e9c1a3983e61fe17a6d8e2367a

              SHA512

              7af3a7ffd41837a4c368f7ccd4bb02ea2db1ad1cc3d971bcf693cef3d6ca56046f47fc7209bfe675ead6793cdfd628d8b1464e074e0cb06b4b0fa4c3c446744f

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18845640.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18845640.exe

              Filesize

              136KB

              MD5

              ace73b2b1f835de11594ea9a243a9f5c

              SHA1

              2f929d1f69784fbe499a95b064679a16947bdd84

              SHA256

              7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

              SHA512

              024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr419578.exe

              Filesize

              278KB

              MD5

              45421b5d132aa2e4d872fb2a5998ceae

              SHA1

              7fffcb816537a873d1c1b3a0f7eea721320c8e10

              SHA256

              be18081f0f5777fdfec0e79812241f55a660e8619ce307c01327ffe23273f544

              SHA512

              bdf382544fbe301fbd08ebf46b97e531d23bd38bc48e118da1ef9aafd97d54576c1e94129b3efca3740c601d787446f82dfe3fa8cfad496a7b4a1ee5ca6a577d

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr419578.exe

              Filesize

              278KB

              MD5

              45421b5d132aa2e4d872fb2a5998ceae

              SHA1

              7fffcb816537a873d1c1b3a0f7eea721320c8e10

              SHA256

              be18081f0f5777fdfec0e79812241f55a660e8619ce307c01327ffe23273f544

              SHA512

              bdf382544fbe301fbd08ebf46b97e531d23bd38bc48e118da1ef9aafd97d54576c1e94129b3efca3740c601d787446f82dfe3fa8cfad496a7b4a1ee5ca6a577d

            • memory/988-193-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-203-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/988-200-0x0000000007270000-0x0000000007280000-memory.dmp

              Filesize

              64KB

            • memory/988-198-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/988-197-0x0000000007270000-0x0000000007280000-memory.dmp

              Filesize

              64KB

            • memory/988-196-0x0000000007270000-0x0000000007280000-memory.dmp

              Filesize

              64KB

            • memory/988-195-0x0000000007270000-0x0000000007280000-memory.dmp

              Filesize

              64KB

            • memory/988-194-0x0000000002C80000-0x0000000002CAD000-memory.dmp

              Filesize

              180KB

            • memory/988-189-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-191-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-202-0x0000000007270000-0x0000000007280000-memory.dmp

              Filesize

              64KB

            • memory/988-201-0x0000000007270000-0x0000000007280000-memory.dmp

              Filesize

              64KB

            • memory/988-166-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-167-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-169-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-171-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-173-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-175-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-177-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-179-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-181-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-183-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-185-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/988-187-0x0000000007110000-0x0000000007122000-memory.dmp

              Filesize

              72KB

            • memory/1740-217-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-229-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-1004-0x00000000071C0000-0x00000000071D0000-memory.dmp

              Filesize

              64KB

            • memory/1740-245-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-243-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-239-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-241-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-237-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-235-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-233-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-231-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-225-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-227-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-220-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-208-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-209-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-211-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-213-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-215-0x0000000007780000-0x00000000077B5000-memory.dmp

              Filesize

              212KB

            • memory/1740-224-0x00000000071C0000-0x00000000071D0000-memory.dmp

              Filesize

              64KB

            • memory/1740-219-0x0000000004550000-0x0000000004596000-memory.dmp

              Filesize

              280KB

            • memory/1740-221-0x00000000071C0000-0x00000000071D0000-memory.dmp

              Filesize

              64KB

            • memory/1740-223-0x00000000071C0000-0x00000000071D0000-memory.dmp

              Filesize

              64KB

            • memory/3692-151-0x0000000007980000-0x00000000079BC000-memory.dmp

              Filesize

              240KB

            • memory/3692-147-0x0000000000BB0000-0x0000000000BD8000-memory.dmp

              Filesize

              160KB

            • memory/3692-148-0x0000000007E50000-0x0000000008468000-memory.dmp

              Filesize

              6.1MB

            • memory/3692-149-0x00000000078E0000-0x00000000078F2000-memory.dmp

              Filesize

              72KB

            • memory/3692-150-0x0000000007A10000-0x0000000007B1A000-memory.dmp

              Filesize

              1.0MB

            • memory/3692-160-0x0000000008C20000-0x0000000008C3E000-memory.dmp

              Filesize

              120KB

            • memory/3692-152-0x0000000007930000-0x0000000007940000-memory.dmp

              Filesize

              64KB

            • memory/3692-153-0x0000000007C80000-0x0000000007CE6000-memory.dmp

              Filesize

              408KB

            • memory/3692-154-0x0000000008820000-0x00000000088B2000-memory.dmp

              Filesize

              584KB

            • memory/3692-155-0x0000000008E70000-0x0000000009414000-memory.dmp

              Filesize

              5.6MB

            • memory/3692-156-0x0000000008910000-0x0000000008960000-memory.dmp

              Filesize

              320KB

            • memory/3692-157-0x0000000008A40000-0x0000000008AB6000-memory.dmp

              Filesize

              472KB

            • memory/3692-158-0x0000000009420000-0x00000000095E2000-memory.dmp

              Filesize

              1.8MB

            • memory/3692-159-0x0000000009B20000-0x000000000A04C000-memory.dmp

              Filesize

              5.2MB