Analysis
-
max time kernel
95s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 21:05
Static task
static1
General
-
Target
3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe
-
Size
564KB
-
MD5
ffed9f5f94c56bc3b74afeb0c5e463c4
-
SHA1
0dba96f6eed285c4da6dfb516067c9be96f08e62
-
SHA256
3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2
-
SHA512
beaba02e51ad105d77a34a51c0b205c7cb1f861d9264c623fb044b9a679982d95351a7f105b863022976bf275f45841685e537d39460d21b6eda91a86453494f
-
SSDEEP
12288:Vy90TlnzXeYOl97fajX6woydZI75zt0PezMMNZdB/2Si:Vy+zOz9qKwVMBGPeQmZd8Si
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it035368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it035368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it035368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it035368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it035368.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it035368.exe -
Executes dropped EXE 4 IoCs
pid Process 1636 zidX3399.exe 1196 it035368.exe 4120 kp043895.exe 4620 lr420039.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it035368.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zidX3399.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zidX3399.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4524 4120 WerFault.exe 86 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1196 it035368.exe 1196 it035368.exe 4120 kp043895.exe 4120 kp043895.exe 4620 lr420039.exe 4620 lr420039.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1196 it035368.exe Token: SeDebugPrivilege 4120 kp043895.exe Token: SeDebugPrivilege 4620 lr420039.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4956 wrote to memory of 1636 4956 3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe 84 PID 4956 wrote to memory of 1636 4956 3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe 84 PID 4956 wrote to memory of 1636 4956 3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe 84 PID 1636 wrote to memory of 1196 1636 zidX3399.exe 85 PID 1636 wrote to memory of 1196 1636 zidX3399.exe 85 PID 1636 wrote to memory of 4120 1636 zidX3399.exe 86 PID 1636 wrote to memory of 4120 1636 zidX3399.exe 86 PID 1636 wrote to memory of 4120 1636 zidX3399.exe 86 PID 4956 wrote to memory of 4620 4956 3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe 89 PID 4956 wrote to memory of 4620 4956 3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe 89 PID 4956 wrote to memory of 4620 4956 3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe"C:\Users\Admin\AppData\Local\Temp\3b5ebfc481620a83cb0d0de8e0f7ff89378342a5c8b0500a9f7412f942e343f2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidX3399.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidX3399.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it035368.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it035368.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp043895.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp043895.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 13244⤵
- Program crash
PID:4524
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr420039.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr420039.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4120 -ip 41201⤵PID:4168
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
409KB
MD5b5a1b1e374299282a35d7d36ad9fc4de
SHA1e3e5087f6cc84ec74091c6d3744f5b808e0a3e87
SHA25604bdab7620115d29e669e7c9fb55c813b313c60e06ec52107a65c3d4a0b2281e
SHA512ce8cbad0db77f7f7c66ab9d7e10aa2d9eeedf626a3745a355175905b8fcc7d7c1b7d0e67c61d99a3b34f64d154aa6aa61963ddf7de9fb242f89019c261b507d6
-
Filesize
409KB
MD5b5a1b1e374299282a35d7d36ad9fc4de
SHA1e3e5087f6cc84ec74091c6d3744f5b808e0a3e87
SHA25604bdab7620115d29e669e7c9fb55c813b313c60e06ec52107a65c3d4a0b2281e
SHA512ce8cbad0db77f7f7c66ab9d7e10aa2d9eeedf626a3745a355175905b8fcc7d7c1b7d0e67c61d99a3b34f64d154aa6aa61963ddf7de9fb242f89019c261b507d6
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
361KB
MD5ae5c2c4d0b6eff00c26363d86a198949
SHA197f534128a6f3421ece851faea0554acf8db228d
SHA256e3b2f6492ac312aa7fc399c736873c1a93c514371d227c71ffe092d898f3f814
SHA512fd0ff8d546e1cd539a3183f7025bd0ee23dc4231750f716d0d08eeaf33904a7844f7b02e2cdf38b72ae5fac0d3af6a6c2f3ed2e1e44ae8035b0e283197aa2a8f
-
Filesize
361KB
MD5ae5c2c4d0b6eff00c26363d86a198949
SHA197f534128a6f3421ece851faea0554acf8db228d
SHA256e3b2f6492ac312aa7fc399c736873c1a93c514371d227c71ffe092d898f3f814
SHA512fd0ff8d546e1cd539a3183f7025bd0ee23dc4231750f716d0d08eeaf33904a7844f7b02e2cdf38b72ae5fac0d3af6a6c2f3ed2e1e44ae8035b0e283197aa2a8f