Analysis

  • max time kernel
    73s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-04-2023 22:00

General

  • Target

    aceab1f3a3b2e6e9f4ebef15b772d6c5ae4a59a41ec72d004a890da9bc4fe948.exe

  • Size

    747KB

  • MD5

    836d02449110354216fc052d76b9f891

  • SHA1

    33dd799a816baeb0d09d2dc05c933a5e21c5af89

  • SHA256

    aceab1f3a3b2e6e9f4ebef15b772d6c5ae4a59a41ec72d004a890da9bc4fe948

  • SHA512

    3f58f55e177b48aed24cad90ebc0af49ffce6c2162259244b70bf7a35bb08bc566bdf3bc9d812bd660d92daba5ec44c992c29e3f40c11d525240413ba6990638

  • SSDEEP

    12288:Zy90/36DKrGVkH4I2yRfwxyrqNHCKZ8d5FOB7V8fcvlabo4wh2dgpfW:ZyA6GrGVkHL28rqRCzKWfcvAboZ4uO

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aceab1f3a3b2e6e9f4ebef15b772d6c5ae4a59a41ec72d004a890da9bc4fe948.exe
    "C:\Users\Admin\AppData\Local\Temp\aceab1f3a3b2e6e9f4ebef15b772d6c5ae4a59a41ec72d004a890da9bc4fe948.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un743718.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un743718.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\05321698.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\05321698.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2296
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk222900.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk222900.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3308
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si034186.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si034186.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4632

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si034186.exe

    Filesize

    136KB

    MD5

    b9f17cc95395f13838ba119abc3f742f

    SHA1

    ecdbc7ef78234c1c7009fdbc6f744c511067767d

    SHA256

    2e10845ea49bdd31991f80c88db940340e9f65c22eb3d1dc719e452fbcc17a15

    SHA512

    bf05c4b13405337bf71e69e8b751af742b24d47de2a46be74a5bb86d37e6eee099ef11d871e3514b1ee9c9458c1ac8127b6858eaae04dfced284d1ec87e34bca

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si034186.exe

    Filesize

    136KB

    MD5

    b9f17cc95395f13838ba119abc3f742f

    SHA1

    ecdbc7ef78234c1c7009fdbc6f744c511067767d

    SHA256

    2e10845ea49bdd31991f80c88db940340e9f65c22eb3d1dc719e452fbcc17a15

    SHA512

    bf05c4b13405337bf71e69e8b751af742b24d47de2a46be74a5bb86d37e6eee099ef11d871e3514b1ee9c9458c1ac8127b6858eaae04dfced284d1ec87e34bca

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un743718.exe

    Filesize

    593KB

    MD5

    6b9aeab88eab3e13f790adf18d567a08

    SHA1

    87eadde9b26606bebc53a95c728749fc0d3ed1ab

    SHA256

    cd44d7764c48829f888a14c5f51325bd720f470a3497cea1e4a3791a8404feb8

    SHA512

    a86e20787e1d38fdb2946e20e9de3b2e3d28a21c4de0969316c9657698622b3c57dee87677826833deb61a0b4fbbfeec6652036277d2492e567dc315dea71b35

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un743718.exe

    Filesize

    593KB

    MD5

    6b9aeab88eab3e13f790adf18d567a08

    SHA1

    87eadde9b26606bebc53a95c728749fc0d3ed1ab

    SHA256

    cd44d7764c48829f888a14c5f51325bd720f470a3497cea1e4a3791a8404feb8

    SHA512

    a86e20787e1d38fdb2946e20e9de3b2e3d28a21c4de0969316c9657698622b3c57dee87677826833deb61a0b4fbbfeec6652036277d2492e567dc315dea71b35

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\05321698.exe

    Filesize

    377KB

    MD5

    ebb81fe7b4c482504ef8440c37d8499f

    SHA1

    20495f1c799d129844cd1abc10304ca2dc6b7134

    SHA256

    ea9207d574e744f3cbcad043f491b38d21d8c1ae7424c6a63baa7a2bcd4f7c8c

    SHA512

    267c025f2dbf57c33337ed7a84c4ed032db882263619bc51b0bb0dbf9606a3e16c21629c42f2b7dea2d92ae63d1549746a14fae0be2a4a36cc17a7045987274c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\05321698.exe

    Filesize

    377KB

    MD5

    ebb81fe7b4c482504ef8440c37d8499f

    SHA1

    20495f1c799d129844cd1abc10304ca2dc6b7134

    SHA256

    ea9207d574e744f3cbcad043f491b38d21d8c1ae7424c6a63baa7a2bcd4f7c8c

    SHA512

    267c025f2dbf57c33337ed7a84c4ed032db882263619bc51b0bb0dbf9606a3e16c21629c42f2b7dea2d92ae63d1549746a14fae0be2a4a36cc17a7045987274c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk222900.exe

    Filesize

    459KB

    MD5

    807306a54a16be77610e2c15e01c2380

    SHA1

    e80d69d7c26522e43c0236f176dcd2e1f18c13c1

    SHA256

    92594849debc3a2c64032f16ec736282db7ce6e4a8bda9e145f61dd37f0fa6be

    SHA512

    87c63b12b4f3b2ddd61f3399b7303aff10e39d9efcf86bd2828a47b6b2fd906cd1da21bf292c03d559312febafa7cdc81af463c72a5ae76a02de4bddc0a9e006

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk222900.exe

    Filesize

    459KB

    MD5

    807306a54a16be77610e2c15e01c2380

    SHA1

    e80d69d7c26522e43c0236f176dcd2e1f18c13c1

    SHA256

    92594849debc3a2c64032f16ec736282db7ce6e4a8bda9e145f61dd37f0fa6be

    SHA512

    87c63b12b4f3b2ddd61f3399b7303aff10e39d9efcf86bd2828a47b6b2fd906cd1da21bf292c03d559312febafa7cdc81af463c72a5ae76a02de4bddc0a9e006

  • memory/2296-148-0x0000000000810000-0x000000000083D000-memory.dmp

    Filesize

    180KB

  • memory/2296-149-0x0000000004F10000-0x00000000054B4000-memory.dmp

    Filesize

    5.6MB

  • memory/2296-150-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-151-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-153-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-155-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-157-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-159-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-161-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-163-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-165-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-167-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-170-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/2296-169-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-173-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-172-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/2296-174-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/2296-176-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-178-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-180-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

  • memory/2296-181-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/2296-182-0x0000000000810000-0x000000000083D000-memory.dmp

    Filesize

    180KB

  • memory/2296-183-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/2296-185-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/2296-186-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/3308-191-0x0000000000820000-0x0000000000866000-memory.dmp

    Filesize

    280KB

  • memory/3308-193-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-192-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3308-195-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3308-194-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-197-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-198-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3308-200-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-202-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-204-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-206-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-208-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-210-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-212-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-214-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-216-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-218-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-220-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-222-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-224-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-226-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-228-0x0000000004D10000-0x0000000004D45000-memory.dmp

    Filesize

    212KB

  • memory/3308-987-0x0000000007900000-0x0000000007F18000-memory.dmp

    Filesize

    6.1MB

  • memory/3308-988-0x0000000007F70000-0x0000000007F82000-memory.dmp

    Filesize

    72KB

  • memory/3308-989-0x0000000007F90000-0x000000000809A000-memory.dmp

    Filesize

    1.0MB

  • memory/3308-990-0x00000000080B0000-0x00000000080EC000-memory.dmp

    Filesize

    240KB

  • memory/3308-991-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/3308-992-0x00000000083B0000-0x0000000008416000-memory.dmp

    Filesize

    408KB

  • memory/3308-993-0x0000000008A80000-0x0000000008B12000-memory.dmp

    Filesize

    584KB

  • memory/3308-994-0x0000000008B30000-0x0000000008B80000-memory.dmp

    Filesize

    320KB

  • memory/3308-995-0x0000000008B90000-0x0000000008C06000-memory.dmp

    Filesize

    472KB

  • memory/3308-996-0x0000000008C40000-0x0000000008C5E000-memory.dmp

    Filesize

    120KB

  • memory/3308-997-0x0000000008D60000-0x0000000008F22000-memory.dmp

    Filesize

    1.8MB

  • memory/3308-998-0x0000000008F30000-0x000000000945C000-memory.dmp

    Filesize

    5.2MB

  • memory/4632-1004-0x0000000000370000-0x0000000000398000-memory.dmp

    Filesize

    160KB

  • memory/4632-1005-0x0000000007460000-0x0000000007470000-memory.dmp

    Filesize

    64KB