Analysis

  • max time kernel
    52s
  • max time network
    74s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/04/2023, 20:56

General

  • Target

    8ac9cafebb47d3586b65ac83680fa222c348a7dde8dfcb239fc74c673d60adf0.exe

  • Size

    704KB

  • MD5

    5e8e2720dd5ee31dc37d4ce989db6a6d

  • SHA1

    9fe9adf39cf2b8430b66bb4a39931f84dcaeada6

  • SHA256

    8ac9cafebb47d3586b65ac83680fa222c348a7dde8dfcb239fc74c673d60adf0

  • SHA512

    eccac50d6ccb7a1c6c1a5f73a3d955dc4f325379cb21deac922267614f32ec2292d016663bbb3b22bce6d3378aa8713537ca0e83933e75662b1bb88e89e215dc

  • SSDEEP

    12288:Py90UYLCTCp4UWokEdJ0nrue2t1vB9RCTkZMI4HKhWS2PwcA+umB+HnMWCbiPK61:PyHsCwWokEdJq+j9aqjdhWS+y+uqMnpN

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ac9cafebb47d3586b65ac83680fa222c348a7dde8dfcb239fc74c673d60adf0.exe
    "C:\Users\Admin\AppData\Local\Temp\8ac9cafebb47d3586b65ac83680fa222c348a7dde8dfcb239fc74c673d60adf0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un255891.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un255891.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr339134.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr339134.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4956
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu024729.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu024729.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4788
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si217965.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si217965.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1736

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si217965.exe

          Filesize

          136KB

          MD5

          8c80b06d843bd6a7599a5be2075d9a55

          SHA1

          caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

          SHA256

          e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

          SHA512

          cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si217965.exe

          Filesize

          136KB

          MD5

          8c80b06d843bd6a7599a5be2075d9a55

          SHA1

          caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

          SHA256

          e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

          SHA512

          cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un255891.exe

          Filesize

          549KB

          MD5

          599ca3c1dc4a455942acf4e3cee1e314

          SHA1

          03d693b8ea44d40426e6b0a034e48abf9c021048

          SHA256

          f9cac0abfc6a68192ac820347805d8077792a760e5f9b8171a318ba3f0dbf53a

          SHA512

          306de73db60dfab23340d905d9e2e1727b400b630c43b45fa62d332cf48116e282bc808c4b01ed1c005e2b5d703be079ad1624809a5af8ea60813600e4df7469

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un255891.exe

          Filesize

          549KB

          MD5

          599ca3c1dc4a455942acf4e3cee1e314

          SHA1

          03d693b8ea44d40426e6b0a034e48abf9c021048

          SHA256

          f9cac0abfc6a68192ac820347805d8077792a760e5f9b8171a318ba3f0dbf53a

          SHA512

          306de73db60dfab23340d905d9e2e1727b400b630c43b45fa62d332cf48116e282bc808c4b01ed1c005e2b5d703be079ad1624809a5af8ea60813600e4df7469

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr339134.exe

          Filesize

          277KB

          MD5

          a448b48a2025ea27e1a58a39079969c3

          SHA1

          901a17c34b1b1c94930f102bac04184aa874f2be

          SHA256

          825c87568fb355d1d5c0514edb47b98b030d3fdf471f70df3218ba41bf9e6eca

          SHA512

          e1578286b000a939e0ce621bf536d25cbcf4283aae0c7b0dab1b51921490294a4ed266aab69ea48000ed39bd6edfc806e94c251dd9e0f947f09ce3cd16f070f3

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr339134.exe

          Filesize

          277KB

          MD5

          a448b48a2025ea27e1a58a39079969c3

          SHA1

          901a17c34b1b1c94930f102bac04184aa874f2be

          SHA256

          825c87568fb355d1d5c0514edb47b98b030d3fdf471f70df3218ba41bf9e6eca

          SHA512

          e1578286b000a939e0ce621bf536d25cbcf4283aae0c7b0dab1b51921490294a4ed266aab69ea48000ed39bd6edfc806e94c251dd9e0f947f09ce3cd16f070f3

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu024729.exe

          Filesize

          361KB

          MD5

          4cc9b6788cb850c63da60a33d9ce5929

          SHA1

          d45654569113e8c712f3053371c2591718a96076

          SHA256

          c13921be9da15ed810405abcffddd018724d2e2ba8740e19fef8aba9941a3f60

          SHA512

          3f20ba742ec83b29cd8cfaa6d53910b2c32a6487392c7715d87ca24590c256339a18994d2fa9666581afa4240acc46ae4dd95f2b93764e6ff1a90cfe46d42b90

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu024729.exe

          Filesize

          361KB

          MD5

          4cc9b6788cb850c63da60a33d9ce5929

          SHA1

          d45654569113e8c712f3053371c2591718a96076

          SHA256

          c13921be9da15ed810405abcffddd018724d2e2ba8740e19fef8aba9941a3f60

          SHA512

          3f20ba742ec83b29cd8cfaa6d53910b2c32a6487392c7715d87ca24590c256339a18994d2fa9666581afa4240acc46ae4dd95f2b93764e6ff1a90cfe46d42b90

        • memory/1736-994-0x0000000007D10000-0x0000000007D20000-memory.dmp

          Filesize

          64KB

        • memory/1736-995-0x00000000079F0000-0x0000000007A3B000-memory.dmp

          Filesize

          300KB

        • memory/1736-993-0x0000000000C70000-0x0000000000C98000-memory.dmp

          Filesize

          160KB

        • memory/4788-211-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-974-0x0000000009BF0000-0x000000000A1F6000-memory.dmp

          Filesize

          6.0MB

        • memory/4788-986-0x00000000048E0000-0x0000000004930000-memory.dmp

          Filesize

          320KB

        • memory/4788-985-0x000000000B230000-0x000000000B75C000-memory.dmp

          Filesize

          5.2MB

        • memory/4788-984-0x000000000B060000-0x000000000B222000-memory.dmp

          Filesize

          1.8MB

        • memory/4788-983-0x000000000AE90000-0x000000000AEAE000-memory.dmp

          Filesize

          120KB

        • memory/4788-982-0x000000000ADD0000-0x000000000AE46000-memory.dmp

          Filesize

          472KB

        • memory/4788-981-0x000000000AD30000-0x000000000ADC2000-memory.dmp

          Filesize

          584KB

        • memory/4788-980-0x000000000A670000-0x000000000A6D6000-memory.dmp

          Filesize

          408KB

        • memory/4788-979-0x0000000007260000-0x0000000007270000-memory.dmp

          Filesize

          64KB

        • memory/4788-978-0x000000000A3E0000-0x000000000A42B000-memory.dmp

          Filesize

          300KB

        • memory/4788-977-0x000000000A360000-0x000000000A39E000-memory.dmp

          Filesize

          248KB

        • memory/4788-976-0x000000000A240000-0x000000000A34A000-memory.dmp

          Filesize

          1.0MB

        • memory/4788-975-0x000000000A210000-0x000000000A222000-memory.dmp

          Filesize

          72KB

        • memory/4788-215-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-213-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-209-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-207-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-205-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-203-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-201-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-199-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-176-0x0000000004770000-0x00000000047AC000-memory.dmp

          Filesize

          240KB

        • memory/4788-177-0x00000000045B0000-0x00000000045F6000-memory.dmp

          Filesize

          280KB

        • memory/4788-178-0x0000000007180000-0x00000000071BA000-memory.dmp

          Filesize

          232KB

        • memory/4788-180-0x0000000007260000-0x0000000007270000-memory.dmp

          Filesize

          64KB

        • memory/4788-179-0x0000000007260000-0x0000000007270000-memory.dmp

          Filesize

          64KB

        • memory/4788-181-0x0000000007260000-0x0000000007270000-memory.dmp

          Filesize

          64KB

        • memory/4788-183-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-185-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-182-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-187-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-189-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-191-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-193-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-195-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4788-197-0x0000000007180000-0x00000000071B5000-memory.dmp

          Filesize

          212KB

        • memory/4956-159-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-133-0x0000000007290000-0x000000000778E000-memory.dmp

          Filesize

          5.0MB

        • memory/4956-168-0x0000000000400000-0x0000000002BAE000-memory.dmp

          Filesize

          39.7MB

        • memory/4956-171-0x0000000002E60000-0x0000000002E70000-memory.dmp

          Filesize

          64KB

        • memory/4956-170-0x0000000002E60000-0x0000000002E70000-memory.dmp

          Filesize

          64KB

        • memory/4956-169-0x0000000002E60000-0x0000000002E70000-memory.dmp

          Filesize

          64KB

        • memory/4956-136-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-166-0x0000000000400000-0x0000000002BAE000-memory.dmp

          Filesize

          39.7MB

        • memory/4956-165-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-138-0x0000000002E60000-0x0000000002E70000-memory.dmp

          Filesize

          64KB

        • memory/4956-163-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-155-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-139-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-140-0x0000000002E60000-0x0000000002E70000-memory.dmp

          Filesize

          64KB

        • memory/4956-161-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-153-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-151-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-149-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-147-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-145-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-142-0x0000000002E60000-0x0000000002E70000-memory.dmp

          Filesize

          64KB

        • memory/4956-143-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-135-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-134-0x0000000004810000-0x0000000004828000-memory.dmp

          Filesize

          96KB

        • memory/4956-157-0x0000000004810000-0x0000000004822000-memory.dmp

          Filesize

          72KB

        • memory/4956-132-0x00000000047B0000-0x00000000047CA000-memory.dmp

          Filesize

          104KB

        • memory/4956-131-0x00000000001D0000-0x00000000001FD000-memory.dmp

          Filesize

          180KB