Analysis

  • max time kernel
    144s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 06:52

General

  • Target

    f359a70c5638b7584b35f5ebd1ab288b39070c5200fd7ec18fbee661b4df32b6.exe

  • Size

    566KB

  • MD5

    83731bd8d29dfc39a6fb2b9b10adc68a

  • SHA1

    0c3915b0b92f3cd87e4a3723c478e28d1a96cab7

  • SHA256

    f359a70c5638b7584b35f5ebd1ab288b39070c5200fd7ec18fbee661b4df32b6

  • SHA512

    0cd955932803014234ec0ecba8b6b4369e4287599cc1199af2a673de754f067ab3da547a6ae2120a901c1f05c748aab39b8403c16883ac5f5807faa9773ff971

  • SSDEEP

    12288:hy90Q0Sqn7YKp/VgWvYyT2yPF0F9miQZK8yKiYtLDv4bEnjUF:hy4vn03W/F89mi8KTkv4bVF

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f359a70c5638b7584b35f5ebd1ab288b39070c5200fd7ec18fbee661b4df32b6.exe
    "C:\Users\Admin\AppData\Local\Temp\f359a70c5638b7584b35f5ebd1ab288b39070c5200fd7ec18fbee661b4df32b6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4112
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCG1930.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCG1930.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it313893.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it313893.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3332
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp743816.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp743816.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2708
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 1868
          4⤵
          • Program crash
          PID:2360
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr544688.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr544688.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2696
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2708 -ip 2708
    1⤵
      PID:4936
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:1628

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr544688.exe

      Filesize

      136KB

      MD5

      8c80b06d843bd6a7599a5be2075d9a55

      SHA1

      caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

      SHA256

      e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

      SHA512

      cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr544688.exe

      Filesize

      136KB

      MD5

      8c80b06d843bd6a7599a5be2075d9a55

      SHA1

      caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

      SHA256

      e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

      SHA512

      cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCG1930.exe

      Filesize

      412KB

      MD5

      b67ef9a51d62b3d30b2677030b426b69

      SHA1

      ec5e468569f41b5ab4d7ea19d8caf848de516988

      SHA256

      fd3c9554c7dd2306c0d5ca5165afe3ff7ae7f6afc25779b570d25442cca5bcd6

      SHA512

      1517855b5e7bbae998cd76c8c86192c1fd0d27b1d2ed412f9becf87fb4416244f5ae73e767c6ece822d0a84e93a43ef118f91ca3056758392c46964e0aade3dd

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCG1930.exe

      Filesize

      412KB

      MD5

      b67ef9a51d62b3d30b2677030b426b69

      SHA1

      ec5e468569f41b5ab4d7ea19d8caf848de516988

      SHA256

      fd3c9554c7dd2306c0d5ca5165afe3ff7ae7f6afc25779b570d25442cca5bcd6

      SHA512

      1517855b5e7bbae998cd76c8c86192c1fd0d27b1d2ed412f9becf87fb4416244f5ae73e767c6ece822d0a84e93a43ef118f91ca3056758392c46964e0aade3dd

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it313893.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it313893.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp743816.exe

      Filesize

      368KB

      MD5

      f7da82b235f53dc2a149883c136dd516

      SHA1

      fb7fa5271c06e16049b92b9e0728186ff7d4c3a4

      SHA256

      d374f9c38d14006759219582bf7f37e2db6de2acfc6dd6d06da281763c0c09bc

      SHA512

      598929be58a735a2330ed9e97b314bdaa5d58d5afb4397af0e7adbe1e25639547cfd58b1c4ee706d3fce5180df8f258a9ceee42ba1c8d70a70b12fe34eef3f9b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp743816.exe

      Filesize

      368KB

      MD5

      f7da82b235f53dc2a149883c136dd516

      SHA1

      fb7fa5271c06e16049b92b9e0728186ff7d4c3a4

      SHA256

      d374f9c38d14006759219582bf7f37e2db6de2acfc6dd6d06da281763c0c09bc

      SHA512

      598929be58a735a2330ed9e97b314bdaa5d58d5afb4397af0e7adbe1e25639547cfd58b1c4ee706d3fce5180df8f258a9ceee42ba1c8d70a70b12fe34eef3f9b

    • memory/2696-968-0x0000000000D50000-0x0000000000D78000-memory.dmp

      Filesize

      160KB

    • memory/2696-969-0x0000000007B30000-0x0000000007B40000-memory.dmp

      Filesize

      64KB

    • memory/2708-187-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-197-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-158-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-156-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-157-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/2708-155-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/2708-160-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/2708-161-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-163-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-165-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-167-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-169-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-171-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-173-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-175-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-177-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-179-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-181-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-183-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-185-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-153-0x0000000002CB0000-0x0000000002CF6000-memory.dmp

      Filesize

      280KB

    • memory/2708-189-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-191-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-193-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-195-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-154-0x00000000072D0000-0x0000000007874000-memory.dmp

      Filesize

      5.6MB

    • memory/2708-199-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-201-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-203-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-205-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-207-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-209-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-211-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-213-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-215-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-217-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-219-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-221-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/2708-950-0x0000000009D00000-0x000000000A318000-memory.dmp

      Filesize

      6.1MB

    • memory/2708-951-0x000000000A320000-0x000000000A332000-memory.dmp

      Filesize

      72KB

    • memory/2708-952-0x000000000A340000-0x000000000A44A000-memory.dmp

      Filesize

      1.0MB

    • memory/2708-953-0x000000000A460000-0x000000000A49C000-memory.dmp

      Filesize

      240KB

    • memory/2708-954-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/2708-955-0x000000000A760000-0x000000000A7C6000-memory.dmp

      Filesize

      408KB

    • memory/2708-956-0x000000000AE20000-0x000000000AEB2000-memory.dmp

      Filesize

      584KB

    • memory/2708-957-0x000000000AED0000-0x000000000AF20000-memory.dmp

      Filesize

      320KB

    • memory/2708-958-0x000000000AF40000-0x000000000AFB6000-memory.dmp

      Filesize

      472KB

    • memory/2708-959-0x000000000B150000-0x000000000B312000-memory.dmp

      Filesize

      1.8MB

    • memory/2708-960-0x000000000B370000-0x000000000B89C000-memory.dmp

      Filesize

      5.2MB

    • memory/2708-961-0x000000000B970000-0x000000000B98E000-memory.dmp

      Filesize

      120KB

    • memory/2708-964-0x0000000002CB0000-0x0000000002CF6000-memory.dmp

      Filesize

      280KB

    • memory/3332-147-0x00000000004D0000-0x00000000004DA000-memory.dmp

      Filesize

      40KB