Analysis

  • max time kernel
    85s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 20:57

General

  • Target

    aec1ce42a40e5f2d5b6207b3c7053d2dbf18ccc57429e2d77ff21d2d439fff89.exe

  • Size

    563KB

  • MD5

    90538ccb612911ec820276e366511bc4

  • SHA1

    43b88f8d5f00507a6bcfb2bd561c03859d0c26c9

  • SHA256

    aec1ce42a40e5f2d5b6207b3c7053d2dbf18ccc57429e2d77ff21d2d439fff89

  • SHA512

    eea6ceca0343537714a7786b6d27180b8b700655a9cae7fed3b946d6232d610e68a54773c8bd5f9c54e0cf85a5c5186434cd7744a2da529fba38cacb39cb9296

  • SSDEEP

    12288:Uy90q/HcHildUJH6nHeKohfH22ECeipKlQbPP8z3r/:UyMCIVKQf2vIpKlCPq3z

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aec1ce42a40e5f2d5b6207b3c7053d2dbf18ccc57429e2d77ff21d2d439fff89.exe
    "C:\Users\Admin\AppData\Local\Temp\aec1ce42a40e5f2d5b6207b3c7053d2dbf18ccc57429e2d77ff21d2d439fff89.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zion4879.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zion4879.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3244
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it367238.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it367238.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:740
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp574345.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp574345.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:792
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 1056
          4⤵
          • Program crash
          PID:1468
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr421493.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr421493.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4336
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 792 -ip 792
    1⤵
      PID:3792

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr421493.exe

            Filesize

            136KB

            MD5

            8c80b06d843bd6a7599a5be2075d9a55

            SHA1

            caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

            SHA256

            e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

            SHA512

            cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr421493.exe

            Filesize

            136KB

            MD5

            8c80b06d843bd6a7599a5be2075d9a55

            SHA1

            caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

            SHA256

            e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

            SHA512

            cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zion4879.exe

            Filesize

            409KB

            MD5

            6d88fb3507c67d548eb22c37e7b9ea6b

            SHA1

            67fb15ba29e95c7bc88368927ef64e6f8f81c26a

            SHA256

            5540363559ab17a99911c7d4a144af5db0c0a6be59222f8f3077cf67c4965647

            SHA512

            f93053933349ddb9f353ce31058a89ab2cb56fcf112086e43a5a3e9cf940c96217bb38b2a0def32572d7a1d3d3971d544b4d6eaaf2d8f950e21a850329df050d

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zion4879.exe

            Filesize

            409KB

            MD5

            6d88fb3507c67d548eb22c37e7b9ea6b

            SHA1

            67fb15ba29e95c7bc88368927ef64e6f8f81c26a

            SHA256

            5540363559ab17a99911c7d4a144af5db0c0a6be59222f8f3077cf67c4965647

            SHA512

            f93053933349ddb9f353ce31058a89ab2cb56fcf112086e43a5a3e9cf940c96217bb38b2a0def32572d7a1d3d3971d544b4d6eaaf2d8f950e21a850329df050d

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it367238.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it367238.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp574345.exe

            Filesize

            361KB

            MD5

            1d5381a55551e29d04ab66452535daa5

            SHA1

            115e20ae11564d3a7e3f0a6bf344552582ee5f54

            SHA256

            d707ee62173fdb6b44491f07effb134974f945c66705d710cda8df759a58718f

            SHA512

            389cc715f52dbb362e2ea2d799aa5543b15ca6e7826b2afb477268a071618369377861932409fc29febc0c61e5b453e6dde1be60ae7c7063816348407b5f05ea

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp574345.exe

            Filesize

            361KB

            MD5

            1d5381a55551e29d04ab66452535daa5

            SHA1

            115e20ae11564d3a7e3f0a6bf344552582ee5f54

            SHA256

            d707ee62173fdb6b44491f07effb134974f945c66705d710cda8df759a58718f

            SHA512

            389cc715f52dbb362e2ea2d799aa5543b15ca6e7826b2afb477268a071618369377861932409fc29febc0c61e5b453e6dde1be60ae7c7063816348407b5f05ea

          • memory/740-147-0x0000000000FE0000-0x0000000000FEA000-memory.dmp

            Filesize

            40KB

          • memory/792-153-0x0000000002BD0000-0x0000000002C16000-memory.dmp

            Filesize

            280KB

          • memory/792-154-0x0000000007260000-0x0000000007804000-memory.dmp

            Filesize

            5.6MB

          • memory/792-155-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-158-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-156-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-160-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-162-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-164-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-166-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-168-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-170-0x0000000004C60000-0x0000000004C70000-memory.dmp

            Filesize

            64KB

          • memory/792-172-0x0000000004C60000-0x0000000004C70000-memory.dmp

            Filesize

            64KB

          • memory/792-171-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-174-0x0000000004C60000-0x0000000004C70000-memory.dmp

            Filesize

            64KB

          • memory/792-177-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-175-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-179-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-181-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-185-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-183-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-187-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-189-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-191-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-193-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-195-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-197-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-199-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-201-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-203-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-205-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-207-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-209-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-211-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-213-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-215-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-217-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-219-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-221-0x0000000007810000-0x0000000007845000-memory.dmp

            Filesize

            212KB

          • memory/792-950-0x0000000009D10000-0x000000000A328000-memory.dmp

            Filesize

            6.1MB

          • memory/792-951-0x0000000004C30000-0x0000000004C42000-memory.dmp

            Filesize

            72KB

          • memory/792-952-0x000000000A370000-0x000000000A47A000-memory.dmp

            Filesize

            1.0MB

          • memory/792-953-0x000000000A480000-0x000000000A4BC000-memory.dmp

            Filesize

            240KB

          • memory/792-954-0x0000000004C60000-0x0000000004C70000-memory.dmp

            Filesize

            64KB

          • memory/792-955-0x000000000A760000-0x000000000A7C6000-memory.dmp

            Filesize

            408KB

          • memory/792-956-0x000000000AE30000-0x000000000AEC2000-memory.dmp

            Filesize

            584KB

          • memory/792-957-0x000000000AFF0000-0x000000000B066000-memory.dmp

            Filesize

            472KB

          • memory/792-958-0x000000000B0C0000-0x000000000B282000-memory.dmp

            Filesize

            1.8MB

          • memory/792-959-0x000000000B2E0000-0x000000000B80C000-memory.dmp

            Filesize

            5.2MB

          • memory/792-960-0x000000000B8E0000-0x000000000B8FE000-memory.dmp

            Filesize

            120KB

          • memory/792-961-0x0000000004B50000-0x0000000004BA0000-memory.dmp

            Filesize

            320KB

          • memory/792-964-0x0000000002BD0000-0x0000000002C16000-memory.dmp

            Filesize

            280KB

          • memory/4336-968-0x0000000000CE0000-0x0000000000D08000-memory.dmp

            Filesize

            160KB

          • memory/4336-969-0x0000000007BE0000-0x0000000007BF0000-memory.dmp

            Filesize

            64KB