Analysis

  • max time kernel
    127s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 21:06

General

  • Target

    bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe

  • Size

    563KB

  • MD5

    8e0d1468c1cd7f3577f19bc81c5ac6f7

  • SHA1

    6446cb8e9b688224dde2869e5a59fdd4a7f3230b

  • SHA256

    bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13

  • SHA512

    d0b296731a13f055d32883068fa611944680ba5f37de8d030a614e60ee84d48f8519988ff921d29fab17d224a2c6024b645f3d967dbd6fc61bc698ea4405e446

  • SSDEEP

    12288:xy90OgClWtONpZpulIwUzR0mQTMCBF6rtKMtu+RV:xyrgClwONpDUAamQTRBEwgu+RV

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe
    "C:\Users\Admin\AppData\Local\Temp\bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4828
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYM3635.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYM3635.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4344
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it284374.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it284374.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1092
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp507224.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp507224.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2040
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1336
          4⤵
          • Program crash
          PID:4528
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr349908.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr349908.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3668
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2040 -ip 2040
    1⤵
      PID:3548
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:4104

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr349908.exe

            Filesize

            136KB

            MD5

            8c80b06d843bd6a7599a5be2075d9a55

            SHA1

            caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

            SHA256

            e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

            SHA512

            cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr349908.exe

            Filesize

            136KB

            MD5

            8c80b06d843bd6a7599a5be2075d9a55

            SHA1

            caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

            SHA256

            e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

            SHA512

            cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYM3635.exe

            Filesize

            409KB

            MD5

            ed51bd8586405e030c4405ce990ed597

            SHA1

            84cff63a7b27f9a4916b2a6cf46489395e48b73a

            SHA256

            746c85d0c09bc1a73acd71ecedf434e7bb051a1b2341dc6f5528d4ad0f7003b1

            SHA512

            37a6b3fff36ef5875671881e155b22d3b6a22580cb4907c004086a041b15c134a918bcb2f04ff51994997c9880e1e8107ed067a77229cc32e92493557bbe0531

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYM3635.exe

            Filesize

            409KB

            MD5

            ed51bd8586405e030c4405ce990ed597

            SHA1

            84cff63a7b27f9a4916b2a6cf46489395e48b73a

            SHA256

            746c85d0c09bc1a73acd71ecedf434e7bb051a1b2341dc6f5528d4ad0f7003b1

            SHA512

            37a6b3fff36ef5875671881e155b22d3b6a22580cb4907c004086a041b15c134a918bcb2f04ff51994997c9880e1e8107ed067a77229cc32e92493557bbe0531

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it284374.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it284374.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp507224.exe

            Filesize

            361KB

            MD5

            850f525ecb2d9ea52cb706e539951562

            SHA1

            5e74c7cfcb5afa19ce2c13c387ae2f7b0cc02d8f

            SHA256

            f1858ddaf804b89311f16f8be59c8c64fe3f6e64449014333f3fbfc63d9a1fd9

            SHA512

            f4f211f9487ac0a85c60dcf954b7ae7f19d7ced36543b632fc7d6110beb39687df3716bf1ec797588505727f16947be6dde4e5e23d3a6f2756f63aa6f76eacf2

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp507224.exe

            Filesize

            361KB

            MD5

            850f525ecb2d9ea52cb706e539951562

            SHA1

            5e74c7cfcb5afa19ce2c13c387ae2f7b0cc02d8f

            SHA256

            f1858ddaf804b89311f16f8be59c8c64fe3f6e64449014333f3fbfc63d9a1fd9

            SHA512

            f4f211f9487ac0a85c60dcf954b7ae7f19d7ced36543b632fc7d6110beb39687df3716bf1ec797588505727f16947be6dde4e5e23d3a6f2756f63aa6f76eacf2

          • memory/1092-147-0x0000000000A10000-0x0000000000A1A000-memory.dmp

            Filesize

            40KB

          • memory/2040-153-0x0000000002BD0000-0x0000000002C16000-memory.dmp

            Filesize

            280KB

          • memory/2040-155-0x0000000007410000-0x0000000007420000-memory.dmp

            Filesize

            64KB

          • memory/2040-154-0x0000000007410000-0x0000000007420000-memory.dmp

            Filesize

            64KB

          • memory/2040-156-0x0000000007420000-0x00000000079C4000-memory.dmp

            Filesize

            5.6MB

          • memory/2040-157-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-158-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-160-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-162-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-164-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-166-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-168-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-170-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-172-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-174-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-176-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-178-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-180-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-182-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-184-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-186-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-188-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-190-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-192-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-194-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-196-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-198-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-200-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-202-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-204-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-206-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-210-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-212-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-208-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-214-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-216-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-218-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-220-0x0000000004E20000-0x0000000004E55000-memory.dmp

            Filesize

            212KB

          • memory/2040-949-0x0000000009D50000-0x000000000A368000-memory.dmp

            Filesize

            6.1MB

          • memory/2040-950-0x00000000073C0000-0x00000000073D2000-memory.dmp

            Filesize

            72KB

          • memory/2040-951-0x000000000A370000-0x000000000A47A000-memory.dmp

            Filesize

            1.0MB

          • memory/2040-952-0x000000000A480000-0x000000000A4BC000-memory.dmp

            Filesize

            240KB

          • memory/2040-953-0x0000000007410000-0x0000000007420000-memory.dmp

            Filesize

            64KB

          • memory/2040-954-0x000000000A760000-0x000000000A7C6000-memory.dmp

            Filesize

            408KB

          • memory/2040-955-0x000000000AF30000-0x000000000AFC2000-memory.dmp

            Filesize

            584KB

          • memory/2040-956-0x000000000AFF0000-0x000000000B066000-memory.dmp

            Filesize

            472KB

          • memory/2040-957-0x000000000B0A0000-0x000000000B0BE000-memory.dmp

            Filesize

            120KB

          • memory/2040-958-0x000000000B1C0000-0x000000000B382000-memory.dmp

            Filesize

            1.8MB

          • memory/2040-959-0x000000000B390000-0x000000000B8BC000-memory.dmp

            Filesize

            5.2MB

          • memory/2040-960-0x0000000004780000-0x00000000047D0000-memory.dmp

            Filesize

            320KB

          • memory/3668-967-0x0000000000330000-0x0000000000358000-memory.dmp

            Filesize

            160KB

          • memory/3668-968-0x0000000007160000-0x0000000007170000-memory.dmp

            Filesize

            64KB