05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde

Analysis

max time kernel
62s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2023 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe
Size

747KB
MD5

d109166d0abea341b013b90fa72993b0
SHA1

ddad95f50e52786510613f8267cfef388de03a98
SHA256

05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde
SHA512

fff3b166e06435a7d5a500c3087ce19eddb53ae412a1eb5168e77dd96cab347eeb1e5972e9e1471c7b5a850877016cf0489102145fcb074db5de2bd262a09b0c
SSDEEP

12288:4y90GmLtZEilUZHJIl30TCXIM/lFV56V5lYPWYEE:4y/mLtZvSHS0O4MHL6V5aOa

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	42138815.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	42138815.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	42138815.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	42138815.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	42138815.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	42138815.exe

Executes dropped EXE 4 IoCs

pid	Process
960	un600094.exe
3604	42138815.exe
1432	rk768831.exe
4332	si138609.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	42138815.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	42138815.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un600094.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un600094.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 2 IoCs

pid	pid_target	Process	procid_target
724	3604	WerFault.exe	84
5060	1432	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3604	42138815.exe
3604	42138815.exe
1432	rk768831.exe
1432	rk768831.exe
4332	si138609.exe
4332	si138609.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	42138815.exe
Token: SeDebugPrivilege	1432	rk768831.exe
Token: SeDebugPrivilege	4332	si138609.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 960	948	05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe	83
PID 948 wrote to memory of 960	948	05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe	83
PID 948 wrote to memory of 960	948	05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe	83
PID 960 wrote to memory of 3604	960	un600094.exe	84
PID 960 wrote to memory of 3604	960	un600094.exe	84
PID 960 wrote to memory of 3604	960	un600094.exe	84
PID 960 wrote to memory of 1432	960	un600094.exe	90
PID 960 wrote to memory of 1432	960	un600094.exe	90
PID 960 wrote to memory of 1432	960	un600094.exe	90
PID 948 wrote to memory of 4332	948	05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe	93
PID 948 wrote to memory of 4332	948	05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe	93
PID 948 wrote to memory of 4332	948	05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe	93

C:\Users\Admin\AppData\Local\Temp\05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe
"C:\Users\Admin\AppData\Local\Temp\05c7666859b4b497216bb769debb7bf3b71eacbcc35377ba7ebbba766c4d8bde.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un600094.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un600094.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\42138815.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\42138815.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 1084
      4⤵
      Program crash
      PID:724
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk768831.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk768831.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 1320
      4⤵
      Program crash
      PID:5060
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si138609.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si138609.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3604 -ip 3604
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1432 -ip 1432
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si138609.exe

Filesize
136KB

MD5
ace73b2b1f835de11594ea9a243a9f5c

SHA1
2f929d1f69784fbe499a95b064679a16947bdd84

SHA256
7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

SHA512
024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si138609.exe

Filesize
136KB

MD5
ace73b2b1f835de11594ea9a243a9f5c

SHA1
2f929d1f69784fbe499a95b064679a16947bdd84

SHA256
7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

SHA512
024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un600094.exe

Filesize
592KB

MD5
a60350665d5544fa472570a241e1b18f

SHA1
5bdc0eb2cbc89baefcf8b43deba02bab87f8eaa8

SHA256
3f3754a9fd30381ee9bc85637342d88311f1e999a256f3dd6b63fb090b998049

SHA512
8e085a91375def29346b3b55346796270b7e0a49dc7293fa3bde0310515140b01a01bd06c8241e42c8f5f032c9a300e247be2a1cb82635bbdadfd717d853d291

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un600094.exe

Filesize
592KB

MD5
a60350665d5544fa472570a241e1b18f

SHA1
5bdc0eb2cbc89baefcf8b43deba02bab87f8eaa8

SHA256
3f3754a9fd30381ee9bc85637342d88311f1e999a256f3dd6b63fb090b998049

SHA512
8e085a91375def29346b3b55346796270b7e0a49dc7293fa3bde0310515140b01a01bd06c8241e42c8f5f032c9a300e247be2a1cb82635bbdadfd717d853d291

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\42138815.exe

Filesize
376KB

MD5
d97c15265161f0230fbc78e683eee758

SHA1
5d384883df18d8f4ebe1f1efa091916107ac3b24

SHA256
9cafef785e64d4ff8fd437a2fdacdc383c7bbadcf3a5fa444058152fb5f93ac2

SHA512
6d2844b5ca9cd1d5bec90f58068449dfc97c61544a19b5d866238acb9010c434f552b8b5d4dc8a6cda8d332c571904148f098cb86ea270b72cf3dfe82692dd36

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\42138815.exe

Filesize
376KB

MD5
d97c15265161f0230fbc78e683eee758

SHA1
5d384883df18d8f4ebe1f1efa091916107ac3b24

SHA256
9cafef785e64d4ff8fd437a2fdacdc383c7bbadcf3a5fa444058152fb5f93ac2

SHA512
6d2844b5ca9cd1d5bec90f58068449dfc97c61544a19b5d866238acb9010c434f552b8b5d4dc8a6cda8d332c571904148f098cb86ea270b72cf3dfe82692dd36

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk768831.exe

Filesize
459KB

MD5
ee85de96b6145b0c083617d097f9a380

SHA1
86b8f0f1d4dcb09a0be66a8ad0a977ee01bcda5e

SHA256
d55b347213dda9ea57db61ba319e95c7095360cb103285784ecc6f18df1dd153

SHA512
c29ece7cd9af64f2540fb00ec4c0e07323886c261a26257d93ac6811e039c286669d5843eb38806dd5ef7568653a9d64963338bbfa816b2e1a2084e645f6958c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk768831.exe

Filesize
459KB

MD5
ee85de96b6145b0c083617d097f9a380

SHA1
86b8f0f1d4dcb09a0be66a8ad0a977ee01bcda5e

SHA256
d55b347213dda9ea57db61ba319e95c7095360cb103285784ecc6f18df1dd153

SHA512
c29ece7cd9af64f2540fb00ec4c0e07323886c261a26257d93ac6811e039c286669d5843eb38806dd5ef7568653a9d64963338bbfa816b2e1a2084e645f6958c

Download Submit
memory/1432-257-0x0000000000820000-0x0000000000866000-memory.dmp

Filesize
280KB

Download
memory/1432-985-0x00000000078D0000-0x0000000007EE8000-memory.dmp

Filesize
6.1MB

Download
memory/1432-997-0x00000000026F0000-0x0000000002740000-memory.dmp

Filesize
320KB

Download
memory/1432-995-0x0000000009310000-0x000000000983C000-memory.dmp

Filesize
5.2MB

Download
memory/1432-994-0x0000000009140000-0x0000000009302000-memory.dmp

Filesize
1.8MB

Download
memory/1432-993-0x0000000008D20000-0x0000000008D3E000-memory.dmp

Filesize
120KB

Download
memory/1432-992-0x0000000008C80000-0x0000000008CF6000-memory.dmp

Filesize
472KB

Download
memory/1432-991-0x0000000008A80000-0x0000000008B12000-memory.dmp

Filesize
584KB

Download
memory/1432-990-0x00000000083B0000-0x0000000008416000-memory.dmp

Filesize
408KB

Download
memory/1432-989-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download
memory/1432-988-0x00000000080B0000-0x00000000080EC000-memory.dmp

Filesize
240KB

Download
memory/1432-987-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/1432-986-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/1432-259-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download
memory/1432-261-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download
memory/1432-223-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-221-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-219-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-217-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-215-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-213-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-211-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-190-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-193-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-195-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-191-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-197-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-199-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-201-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-203-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-205-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-207-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/1432-209-0x00000000053D0000-0x0000000005405000-memory.dmp

Filesize
212KB

Download
memory/3604-175-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-185-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/3604-173-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-171-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-183-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/3604-182-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/3604-180-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/3604-150-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-177-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-179-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/3604-155-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-178-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/3604-151-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-153-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-184-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/3604-169-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-167-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-165-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-163-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-161-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-159-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-157-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/3604-149-0x0000000004F00000-0x00000000054A4000-memory.dmp

Filesize
5.6MB

Download
memory/3604-148-0x0000000000910000-0x000000000093D000-memory.dmp

Filesize
180KB

Download
memory/4332-1003-0x0000000000ED0000-0x0000000000EF8000-memory.dmp

Filesize
160KB

Download
memory/4332-1004-0x0000000007D10000-0x0000000007D20000-memory.dmp

Filesize
64KB

Download