Analysis

  • max time kernel
    138s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 21:04

General

  • Target

    b6b0dbc702e182585c0374dab8e77a2bf64ca3ac78039be0922f41db3ff4768b.exe

  • Size

    704KB

  • MD5

    a1fb54fc801151951bec3e3daaa99708

  • SHA1

    3b8a4b46ae84fe565fbefd42a89546c89ee91e8d

  • SHA256

    b6b0dbc702e182585c0374dab8e77a2bf64ca3ac78039be0922f41db3ff4768b

  • SHA512

    71130db6f345661e73d036099e3cb030e1083174953e75fee5dc4c53e168736810ab3d9bbd77f812ac0ee8542654312da32be4fd0b1f520142af20a173585c5b

  • SSDEEP

    12288:1y90n8pMKFYXg13jFlThU/Vim9rKERCDqr/pNI1AzCeaIzxMkA/KGDovT2E9BVBQ:1yVpM2Ygjji/VAqz/pUszaI9Le+T3ncP

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6b0dbc702e182585c0374dab8e77a2bf64ca3ac78039be0922f41db3ff4768b.exe
    "C:\Users\Admin\AppData\Local\Temp\b6b0dbc702e182585c0374dab8e77a2bf64ca3ac78039be0922f41db3ff4768b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un894704.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un894704.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4332
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr802234.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr802234.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:100
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 1084
          4⤵
          • Program crash
          PID:4384
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu028242.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu028242.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4696
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1152
          4⤵
          • Program crash
          PID:2896
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si612855.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si612855.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4292
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 100 -ip 100
    1⤵
      PID:688
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4696 -ip 4696
      1⤵
        PID:1640

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si612855.exe

              Filesize

              136KB

              MD5

              8c80b06d843bd6a7599a5be2075d9a55

              SHA1

              caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

              SHA256

              e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

              SHA512

              cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si612855.exe

              Filesize

              136KB

              MD5

              8c80b06d843bd6a7599a5be2075d9a55

              SHA1

              caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

              SHA256

              e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

              SHA512

              cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un894704.exe

              Filesize

              550KB

              MD5

              a90f52d52ae7bfd51b7031b426d528a8

              SHA1

              44bb4b4b96cf83039b7bd85bfb092a0d97ad3afc

              SHA256

              c507e89d51f51cb5b50b91898c4ebd4ff6ce800084054ea8be9e607ed15cfee8

              SHA512

              ae5127134f7d7bcc4912722fc34c247d1fd76b85eb6ba3c65910bd735596ad77bf5bcc8870b01669b201d36f1322f1f30c0a256ce3bd051064e3739eca670e56

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un894704.exe

              Filesize

              550KB

              MD5

              a90f52d52ae7bfd51b7031b426d528a8

              SHA1

              44bb4b4b96cf83039b7bd85bfb092a0d97ad3afc

              SHA256

              c507e89d51f51cb5b50b91898c4ebd4ff6ce800084054ea8be9e607ed15cfee8

              SHA512

              ae5127134f7d7bcc4912722fc34c247d1fd76b85eb6ba3c65910bd735596ad77bf5bcc8870b01669b201d36f1322f1f30c0a256ce3bd051064e3739eca670e56

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr802234.exe

              Filesize

              278KB

              MD5

              a22b7af61aeb254462ca0995f30c9e3e

              SHA1

              10bd3583d885e8df9a05a90d87ffb4516d73d3f0

              SHA256

              95492f20a63cffd9a323ffe0821e397a8e3e2745d43a9ce9b92f385628201a71

              SHA512

              7e05d1636e3853635a0a47214d32772beddfab212b6cab475f70ccc35c3f2eecf9134e0f014798856f1e169a1cc09d3105d90963c5d303e36c9ff56d08cfa251

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr802234.exe

              Filesize

              278KB

              MD5

              a22b7af61aeb254462ca0995f30c9e3e

              SHA1

              10bd3583d885e8df9a05a90d87ffb4516d73d3f0

              SHA256

              95492f20a63cffd9a323ffe0821e397a8e3e2745d43a9ce9b92f385628201a71

              SHA512

              7e05d1636e3853635a0a47214d32772beddfab212b6cab475f70ccc35c3f2eecf9134e0f014798856f1e169a1cc09d3105d90963c5d303e36c9ff56d08cfa251

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu028242.exe

              Filesize

              361KB

              MD5

              f58b1135dfd5c1dfad5dec9fe5043918

              SHA1

              ee6e36574330c63e6d3ec47a2e71cff765814e67

              SHA256

              66b138ef3c352aa5fe3eb42af57584f9c192f82032c582625a0337be705765ff

              SHA512

              571715868f850cb7fec0ec1c5ca1a9d05164a6b3f744b304da82bd0bcaa547ddc80b5496d849e291c4b3c30d9957541222d03a214a223eb19b777c2072f329f1

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu028242.exe

              Filesize

              361KB

              MD5

              f58b1135dfd5c1dfad5dec9fe5043918

              SHA1

              ee6e36574330c63e6d3ec47a2e71cff765814e67

              SHA256

              66b138ef3c352aa5fe3eb42af57584f9c192f82032c582625a0337be705765ff

              SHA512

              571715868f850cb7fec0ec1c5ca1a9d05164a6b3f744b304da82bd0bcaa547ddc80b5496d849e291c4b3c30d9957541222d03a214a223eb19b777c2072f329f1

            • memory/100-161-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-171-0x00000000048C0000-0x00000000048D0000-memory.dmp

              Filesize

              64KB

            • memory/100-150-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-151-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-153-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-155-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-157-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-159-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-148-0x0000000002BB0000-0x0000000002BDD000-memory.dmp

              Filesize

              180KB

            • memory/100-163-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-165-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-167-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-169-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-149-0x00000000071D0000-0x0000000007774000-memory.dmp

              Filesize

              5.6MB

            • memory/100-173-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-176-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-175-0x00000000048C0000-0x00000000048D0000-memory.dmp

              Filesize

              64KB

            • memory/100-172-0x00000000048C0000-0x00000000048D0000-memory.dmp

              Filesize

              64KB

            • memory/100-178-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-180-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

              Filesize

              72KB

            • memory/100-181-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/100-182-0x0000000002BB0000-0x0000000002BDD000-memory.dmp

              Filesize

              180KB

            • memory/100-183-0x00000000048C0000-0x00000000048D0000-memory.dmp

              Filesize

              64KB

            • memory/100-185-0x00000000048C0000-0x00000000048D0000-memory.dmp

              Filesize

              64KB

            • memory/100-186-0x0000000000400000-0x0000000002BAF000-memory.dmp

              Filesize

              39.7MB

            • memory/4292-1004-0x0000000000B90000-0x0000000000BB8000-memory.dmp

              Filesize

              160KB

            • memory/4292-1005-0x0000000007920000-0x0000000007930000-memory.dmp

              Filesize

              64KB

            • memory/4696-191-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-194-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-196-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-198-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-200-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-202-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-204-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-206-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-208-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-210-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-212-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-214-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-216-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-218-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-220-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-222-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-224-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-298-0x0000000002BD0000-0x0000000002C16000-memory.dmp

              Filesize

              280KB

            • memory/4696-299-0x00000000048B0000-0x00000000048C0000-memory.dmp

              Filesize

              64KB

            • memory/4696-302-0x00000000048B0000-0x00000000048C0000-memory.dmp

              Filesize

              64KB

            • memory/4696-986-0x0000000009C60000-0x000000000A278000-memory.dmp

              Filesize

              6.1MB

            • memory/4696-987-0x000000000A320000-0x000000000A332000-memory.dmp

              Filesize

              72KB

            • memory/4696-988-0x000000000A340000-0x000000000A44A000-memory.dmp

              Filesize

              1.0MB

            • memory/4696-989-0x000000000A460000-0x000000000A49C000-memory.dmp

              Filesize

              240KB

            • memory/4696-990-0x00000000048B0000-0x00000000048C0000-memory.dmp

              Filesize

              64KB

            • memory/4696-991-0x000000000A760000-0x000000000A7C6000-memory.dmp

              Filesize

              408KB

            • memory/4696-992-0x000000000AE20000-0x000000000AEB2000-memory.dmp

              Filesize

              584KB

            • memory/4696-993-0x000000000AEF0000-0x000000000AF66000-memory.dmp

              Filesize

              472KB

            • memory/4696-994-0x000000000AFD0000-0x000000000B192000-memory.dmp

              Filesize

              1.8MB

            • memory/4696-192-0x0000000004C20000-0x0000000004C55000-memory.dmp

              Filesize

              212KB

            • memory/4696-995-0x000000000B1A0000-0x000000000B6CC000-memory.dmp

              Filesize

              5.2MB

            • memory/4696-996-0x000000000B7E0000-0x000000000B7FE000-memory.dmp

              Filesize

              120KB

            • memory/4696-998-0x0000000004730000-0x0000000004780000-memory.dmp

              Filesize

              320KB