Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 11:36

General

  • Target

    ec22b1e1f1afd6fdcd2dfe6c4ff888bfce39b7b6a1ae514902e4667f54043c49.exe

  • Size

    705KB

  • MD5

    4be6b4ada7a029153694891b0a5a0cdf

  • SHA1

    1b9fb012efbff0f52c07388f0cb9fcbcf147e6ae

  • SHA256

    ec22b1e1f1afd6fdcd2dfe6c4ff888bfce39b7b6a1ae514902e4667f54043c49

  • SHA512

    55a5ef9b7f95f6df2fd5c58655a11bbca960679e3335145b53447dd80788b0767cc6d64da98a67da749544c96f2962ac10ad61cd6e51d78b8ff3fc0006a18e9a

  • SSDEEP

    12288:ty909eQyQhVMo3TJb9+HT0YjL8gNaitdg2ZoyzPXIHwD3EOd+3B:tygyeio3TJbIHT0WI4fZey0Hrx

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec22b1e1f1afd6fdcd2dfe6c4ff888bfce39b7b6a1ae514902e4667f54043c49.exe
    "C:\Users\Admin\AppData\Local\Temp\ec22b1e1f1afd6fdcd2dfe6c4ff888bfce39b7b6a1ae514902e4667f54043c49.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699674.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699674.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr571946.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr571946.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4300
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 1104
          4⤵
          • Program crash
          PID:1624
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu253502.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu253502.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 1316
          4⤵
          • Program crash
          PID:720
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si862961.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si862961.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1536
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4300 -ip 4300
    1⤵
      PID:2968
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3804 -ip 3804
      1⤵
        PID:4924

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si862961.exe

        Filesize

        136KB

        MD5

        8c80b06d843bd6a7599a5be2075d9a55

        SHA1

        caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

        SHA256

        e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

        SHA512

        cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si862961.exe

        Filesize

        136KB

        MD5

        8c80b06d843bd6a7599a5be2075d9a55

        SHA1

        caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

        SHA256

        e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

        SHA512

        cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699674.exe

        Filesize

        551KB

        MD5

        a56a685f65c5243f6b48f20f5c9f76d9

        SHA1

        ca896f209aaf30bfc7b7efca88819a36e02be90a

        SHA256

        6e2c9240554d99cb515d18f6b1f6b64efb253dffddb0dc6c341769d4615d01b6

        SHA512

        e112eb8af1b81791480c084e0fc8cfbb6a8bcb1a3d24e8451b12a79917da7305887c5c4b4f2fbf49b90e876c85f6d4d26874bd930b607ba077025966ae62fcaa

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699674.exe

        Filesize

        551KB

        MD5

        a56a685f65c5243f6b48f20f5c9f76d9

        SHA1

        ca896f209aaf30bfc7b7efca88819a36e02be90a

        SHA256

        6e2c9240554d99cb515d18f6b1f6b64efb253dffddb0dc6c341769d4615d01b6

        SHA512

        e112eb8af1b81791480c084e0fc8cfbb6a8bcb1a3d24e8451b12a79917da7305887c5c4b4f2fbf49b90e876c85f6d4d26874bd930b607ba077025966ae62fcaa

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr571946.exe

        Filesize

        286KB

        MD5

        ab57822baa0f6b9c19b6e64b279509e2

        SHA1

        d5da6b925dcebf583c7c24ea612000a4375244e3

        SHA256

        80606103406c3ac37dae614b27468e2877aea4b8d0f821677cb49f00b432fcaa

        SHA512

        7716473db004db554ffa2c3a3dd15a7ffb886f31fb93a8eea48a2de95b173cebfb12597e8183619a71a8259e358d579292b0bd636aa0dd9a5e86f458097b707e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr571946.exe

        Filesize

        286KB

        MD5

        ab57822baa0f6b9c19b6e64b279509e2

        SHA1

        d5da6b925dcebf583c7c24ea612000a4375244e3

        SHA256

        80606103406c3ac37dae614b27468e2877aea4b8d0f821677cb49f00b432fcaa

        SHA512

        7716473db004db554ffa2c3a3dd15a7ffb886f31fb93a8eea48a2de95b173cebfb12597e8183619a71a8259e358d579292b0bd636aa0dd9a5e86f458097b707e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu253502.exe

        Filesize

        369KB

        MD5

        8756a55ff1d5e2e548cdc45772d3f916

        SHA1

        85a5aa4f0bb4912866aaa5df7d9881cadd4711c8

        SHA256

        3959834becba5fdb7403e71f41f74f23929205c6519d91897893b93e2c021017

        SHA512

        fbc39d03eca37967ce670dcbbe6555226b539ae147a9298cd0c27e6c884d0d94a8b0e77623238af17c223df21cfe07f30ebb670bd6e1b154d459278efcca321e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu253502.exe

        Filesize

        369KB

        MD5

        8756a55ff1d5e2e548cdc45772d3f916

        SHA1

        85a5aa4f0bb4912866aaa5df7d9881cadd4711c8

        SHA256

        3959834becba5fdb7403e71f41f74f23929205c6519d91897893b93e2c021017

        SHA512

        fbc39d03eca37967ce670dcbbe6555226b539ae147a9298cd0c27e6c884d0d94a8b0e77623238af17c223df21cfe07f30ebb670bd6e1b154d459278efcca321e

      • memory/1536-1005-0x00000000078C0000-0x00000000078D0000-memory.dmp

        Filesize

        64KB

      • memory/1536-1004-0x0000000000770000-0x0000000000798000-memory.dmp

        Filesize

        160KB

      • memory/3804-228-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-987-0x0000000009CE0000-0x000000000A2F8000-memory.dmp

        Filesize

        6.1MB

      • memory/3804-998-0x0000000006C70000-0x0000000006CC0000-memory.dmp

        Filesize

        320KB

      • memory/3804-997-0x000000000BA20000-0x000000000BA3E000-memory.dmp

        Filesize

        120KB

      • memory/3804-996-0x000000000B3E0000-0x000000000B90C000-memory.dmp

        Filesize

        5.2MB

      • memory/3804-995-0x000000000B210000-0x000000000B3D2000-memory.dmp

        Filesize

        1.8MB

      • memory/3804-994-0x000000000B130000-0x000000000B1A6000-memory.dmp

        Filesize

        472KB

      • memory/3804-993-0x000000000AE30000-0x000000000AEC2000-memory.dmp

        Filesize

        584KB

      • memory/3804-992-0x000000000A760000-0x000000000A7C6000-memory.dmp

        Filesize

        408KB

      • memory/3804-991-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3804-990-0x000000000A460000-0x000000000A49C000-memory.dmp

        Filesize

        240KB

      • memory/3804-989-0x000000000A340000-0x000000000A44A000-memory.dmp

        Filesize

        1.0MB

      • memory/3804-988-0x000000000A320000-0x000000000A332000-memory.dmp

        Filesize

        72KB

      • memory/3804-226-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-218-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-220-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-224-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-222-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-216-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-214-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-212-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-192-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3804-194-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-195-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3804-193-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-191-0x0000000002CF0000-0x0000000002D36000-memory.dmp

        Filesize

        280KB

      • memory/3804-197-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3804-200-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-202-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-198-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-204-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-206-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-208-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/3804-210-0x0000000007170000-0x00000000071A5000-memory.dmp

        Filesize

        212KB

      • memory/4300-177-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-151-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-186-0x0000000000400000-0x0000000002BB1000-memory.dmp

        Filesize

        39.7MB

      • memory/4300-185-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/4300-184-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/4300-183-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/4300-181-0x0000000000400000-0x0000000002BB1000-memory.dmp

        Filesize

        39.7MB

      • memory/4300-153-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-180-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/4300-159-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-179-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/4300-178-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/4300-157-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-173-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-155-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-171-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-169-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-167-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-165-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-163-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-161-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-175-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-150-0x0000000004B10000-0x0000000004B22000-memory.dmp

        Filesize

        72KB

      • memory/4300-149-0x00000000072E0000-0x0000000007884000-memory.dmp

        Filesize

        5.6MB

      • memory/4300-148-0x0000000002BC0000-0x0000000002BED000-memory.dmp

        Filesize

        180KB