da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52

Analysis

max time kernel
97s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2023, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe
Size

618KB
MD5

f29c265c6697687d16a4b627d425b87b
SHA1

a2677b526a73b460e5fb916bf255c03dfe45da4b
SHA256

da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52
SHA512

7ecedb52930dc21a59bc4828e92621253a9c0deb1c1d611cdca77a14a86e9ebe0cd83d44b2b0dd3b5ccccfda1bee4283e61b2dd0e5138f65b9378ffa16e980f6
SSDEEP

12288:Afy90HmEfYQ42f1RcA8zYcAEYjHR1xjAHqk9F6ArLJn:Afy9EQQ42tRcicIRHJkhvx

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	58844932.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	58844932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	58844932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	58844932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	58844932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	58844932.exe

Executes dropped EXE 4 IoCs

pid	Process
4640	st422953.exe
844	58844932.exe
3320	kp696167.exe
2932	lr144902.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	58844932.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	st422953.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	st422953.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4104	3320	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
844	58844932.exe
844	58844932.exe
3320	kp696167.exe
3320	kp696167.exe
2932	lr144902.exe
2932	lr144902.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	58844932.exe
Token: SeDebugPrivilege	3320	kp696167.exe
Token: SeDebugPrivilege	2932	lr144902.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 4640	444	da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe	83
PID 444 wrote to memory of 4640	444	da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe	83
PID 444 wrote to memory of 4640	444	da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe	83
PID 4640 wrote to memory of 844	4640	st422953.exe	84
PID 4640 wrote to memory of 844	4640	st422953.exe	84
PID 4640 wrote to memory of 3320	4640	st422953.exe	91
PID 4640 wrote to memory of 3320	4640	st422953.exe	91
PID 4640 wrote to memory of 3320	4640	st422953.exe	91
PID 444 wrote to memory of 2932	444	da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe	96
PID 444 wrote to memory of 2932	444	da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe	96
PID 444 wrote to memory of 2932	444	da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe	96

C:\Users\Admin\AppData\Local\Temp\da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe
"C:\Users\Admin\AppData\Local\Temp\da03a91e784240c6a30d1447c142c8bfa819292d7e771f526224e40ad0deac52.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:444
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st422953.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st422953.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\58844932.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\58844932.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:844
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp696167.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp696167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 1320
      4⤵
      Program crash
      PID:4104
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr144902.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr144902.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3320 -ip 3320
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr144902.exe

Filesize
136KB

MD5
ace73b2b1f835de11594ea9a243a9f5c

SHA1
2f929d1f69784fbe499a95b064679a16947bdd84

SHA256
7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

SHA512
024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr144902.exe

Filesize
136KB

MD5
ace73b2b1f835de11594ea9a243a9f5c

SHA1
2f929d1f69784fbe499a95b064679a16947bdd84

SHA256
7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

SHA512
024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st422953.exe

Filesize
464KB

MD5
44106a045c7b3d66964ccba73e2c69e2

SHA1
8ffeb530e18f6ef01a321a15dce193bdf6ab5562

SHA256
6d7030a763988dd87847a64ecab67859029eb8799bb454ed61d11c00cd7480ac

SHA512
fdd823b266f527b3ecfe17b40f3353727005479887300e22f4e7d077a87b28ceb303a7393edcd385afa9fdaa6d88a260dee01e08dbeb7003755154d710f34c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st422953.exe

Filesize
464KB

MD5
44106a045c7b3d66964ccba73e2c69e2

SHA1
8ffeb530e18f6ef01a321a15dce193bdf6ab5562

SHA256
6d7030a763988dd87847a64ecab67859029eb8799bb454ed61d11c00cd7480ac

SHA512
fdd823b266f527b3ecfe17b40f3353727005479887300e22f4e7d077a87b28ceb303a7393edcd385afa9fdaa6d88a260dee01e08dbeb7003755154d710f34c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\58844932.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\58844932.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp696167.exe

Filesize
478KB

MD5
f21e4fae18a04740d0fed3e578c15a13

SHA1
d078c55675a2438dac11964663ce44ea7e03252e

SHA256
5fda1ef8921fa16465bca77c8823136befa306b1963c25200aeaa991eab6b4ff

SHA512
eb99f1a015c66be9af151847f41503aa045dff692ae64b5c8cca915efc396b6cf28928b6af2b716b97f6e6d60bb00f9ecf87bd3195aa8cb4a54063fe43dcbf01

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp696167.exe

Filesize
478KB

MD5
f21e4fae18a04740d0fed3e578c15a13

SHA1
d078c55675a2438dac11964663ce44ea7e03252e

SHA256
5fda1ef8921fa16465bca77c8823136befa306b1963c25200aeaa991eab6b4ff

SHA512
eb99f1a015c66be9af151847f41503aa045dff692ae64b5c8cca915efc396b6cf28928b6af2b716b97f6e6d60bb00f9ecf87bd3195aa8cb4a54063fe43dcbf01

Download Submit
memory/844-147-0x00000000000A0000-0x00000000000AA000-memory.dmp

Filesize
40KB

Download
memory/2932-968-0x0000000000220000-0x0000000000248000-memory.dmp

Filesize
160KB

Download
memory/2932-969-0x0000000007000000-0x0000000007010000-memory.dmp

Filesize
64KB

Download
memory/3320-185-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-197-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-155-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-156-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-158-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-160-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-162-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-164-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-166-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-168-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-170-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-172-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-176-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-174-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-177-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/3320-181-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/3320-180-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-179-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/3320-183-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-153-0x00000000009C0000-0x0000000000A06000-memory.dmp

Filesize
280KB

Download
memory/3320-187-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-189-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-191-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-193-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-195-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-154-0x0000000004F40000-0x00000000054E4000-memory.dmp

Filesize
5.6MB

Download
memory/3320-199-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-201-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-203-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-205-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-207-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-209-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-211-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-213-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-215-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-217-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-219-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-221-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/3320-950-0x0000000007970000-0x0000000007F88000-memory.dmp

Filesize
6.1MB

Download
memory/3320-951-0x0000000004F10000-0x0000000004F22000-memory.dmp

Filesize
72KB

Download
memory/3320-952-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/3320-953-0x00000000080B0000-0x00000000080EC000-memory.dmp

Filesize
240KB

Download
memory/3320-954-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/3320-955-0x00000000083B0000-0x0000000008416000-memory.dmp

Filesize
408KB

Download
memory/3320-956-0x0000000008A80000-0x0000000008B12000-memory.dmp

Filesize
584KB

Download
memory/3320-957-0x0000000008B20000-0x0000000008B96000-memory.dmp

Filesize
472KB

Download
memory/3320-958-0x0000000008BE0000-0x0000000008BFE000-memory.dmp

Filesize
120KB

Download
memory/3320-959-0x0000000008E00000-0x0000000008FC2000-memory.dmp

Filesize
1.8MB

Download
memory/3320-960-0x0000000008FD0000-0x00000000094FC000-memory.dmp

Filesize
5.2MB

Download
memory/3320-961-0x00000000028B0000-0x0000000002900000-memory.dmp

Filesize
320KB

Download