Analysis

  • max time kernel
    129s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2023, 02:31

General

  • Target

    188bc9e4d4a1e08a29a6289130c3275d2ecf8e9d0bb7d9d507430894a27e6e75.exe

  • Size

    695KB

  • MD5

    1a63833858ebc050a7904b232d80ea98

  • SHA1

    75214183c39f97a2b7ea5c7e6b85dc98b4234b0a

  • SHA256

    188bc9e4d4a1e08a29a6289130c3275d2ecf8e9d0bb7d9d507430894a27e6e75

  • SHA512

    a3a48a368215c9b3097c8f821ac58955ba6fc933072b5889d6fedf83b74e2cd15fbf0e10beb889856abd5a21b19bf64797f05fcc6bdf1be8ff524cc8e13430a7

  • SSDEEP

    12288:Qy90mtnyxSRJJderq3jGuO/Cb/+tZ9COLs9IoJgPKJ742WX63u18bzKLA+NY1T:QyTtyxSR4GCUb/+tXCH2OgPI4H63u18f

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\188bc9e4d4a1e08a29a6289130c3275d2ecf8e9d0bb7d9d507430894a27e6e75.exe
    "C:\Users\Admin\AppData\Local\Temp\188bc9e4d4a1e08a29a6289130c3275d2ecf8e9d0bb7d9d507430894a27e6e75.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un963722.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un963722.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\52509556.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\52509556.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1396
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1108
          4⤵
          • Program crash
          PID:3092
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk191907.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk191907.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1812
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 1324
          4⤵
          • Program crash
          PID:4964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si406889.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si406889.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2252
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1396 -ip 1396
    1⤵
      PID:1336
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1812 -ip 1812
      1⤵
        PID:4540
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:892

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si406889.exe

        Filesize

        136KB

        MD5

        bddaadcc91f12566dce088dfba102c2a

        SHA1

        6a141a09619ea3f5bbe2d946df9a8c427beb89f2

        SHA256

        536a77d74988fc47e1d6b53be4701d289ecf4e3598b02adcd936b4f29017a4f4

        SHA512

        f4b12e80f23ddbfd3c9fa79a009cb04e372f1ef6b48ea947b8c0fb14dfd3240c497be28023c78005b8dfd36a4080d98a9750606edf0a1fdfe57f53ef494e5c91

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si406889.exe

        Filesize

        136KB

        MD5

        bddaadcc91f12566dce088dfba102c2a

        SHA1

        6a141a09619ea3f5bbe2d946df9a8c427beb89f2

        SHA256

        536a77d74988fc47e1d6b53be4701d289ecf4e3598b02adcd936b4f29017a4f4

        SHA512

        f4b12e80f23ddbfd3c9fa79a009cb04e372f1ef6b48ea947b8c0fb14dfd3240c497be28023c78005b8dfd36a4080d98a9750606edf0a1fdfe57f53ef494e5c91

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un963722.exe

        Filesize

        541KB

        MD5

        28a44fc49ae2f565da5559a792ee6712

        SHA1

        531520f9557ce47522ed502eb87423fc3c5e8c23

        SHA256

        16a125c6d406bc7cf8a5ec6d8a8d2b55026ad98052325a93457c1745130230f7

        SHA512

        d6d754ef559b21f6f0c5c73185944e33518a25d9de5ef0ed457465c9a955361d036c9be8e9413f9f26bc93f0ed371cd53263eebf80c393cd58e65766c0c335d0

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un963722.exe

        Filesize

        541KB

        MD5

        28a44fc49ae2f565da5559a792ee6712

        SHA1

        531520f9557ce47522ed502eb87423fc3c5e8c23

        SHA256

        16a125c6d406bc7cf8a5ec6d8a8d2b55026ad98052325a93457c1745130230f7

        SHA512

        d6d754ef559b21f6f0c5c73185944e33518a25d9de5ef0ed457465c9a955361d036c9be8e9413f9f26bc93f0ed371cd53263eebf80c393cd58e65766c0c335d0

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\52509556.exe

        Filesize

        258KB

        MD5

        c8da50db01eb8983d3ec7006e7986a60

        SHA1

        59cff2fdcea74373c228c6faaa29b99c4998a9b2

        SHA256

        ac78483a3f0eaebae73fa4975e68cb60d351e1ed67d7c3dab6037a957374054a

        SHA512

        ea08770f60a342baee8d8a7c227591eee5a1bfbd08c984ab051b6c3af310146575a973a13d7c5577636c2c07c033a12c0f44e5b5dda01d05f5fa057579ccf9da

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\52509556.exe

        Filesize

        258KB

        MD5

        c8da50db01eb8983d3ec7006e7986a60

        SHA1

        59cff2fdcea74373c228c6faaa29b99c4998a9b2

        SHA256

        ac78483a3f0eaebae73fa4975e68cb60d351e1ed67d7c3dab6037a957374054a

        SHA512

        ea08770f60a342baee8d8a7c227591eee5a1bfbd08c984ab051b6c3af310146575a973a13d7c5577636c2c07c033a12c0f44e5b5dda01d05f5fa057579ccf9da

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk191907.exe

        Filesize

        340KB

        MD5

        0a784a35b58cf3b50aa34ec895c3a0af

        SHA1

        b39a0a1a0ae557d4eeba2a81bb1fd7372b461538

        SHA256

        b9021b21935e00b602e2fddd13daee23e611f4a450ec99e92f3eceadf4934907

        SHA512

        e50c8195ee86a1970ff5035d7c7a02490a86e1a3f514fdba011143e485992ea4bb7e838d92eebb7d3585be4024d8b5e333c47399a512c4a87ae8ce3e721032cb

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk191907.exe

        Filesize

        340KB

        MD5

        0a784a35b58cf3b50aa34ec895c3a0af

        SHA1

        b39a0a1a0ae557d4eeba2a81bb1fd7372b461538

        SHA256

        b9021b21935e00b602e2fddd13daee23e611f4a450ec99e92f3eceadf4934907

        SHA512

        e50c8195ee86a1970ff5035d7c7a02490a86e1a3f514fdba011143e485992ea4bb7e838d92eebb7d3585be4024d8b5e333c47399a512c4a87ae8ce3e721032cb

      • memory/1396-148-0x0000000007340000-0x00000000078E4000-memory.dmp

        Filesize

        5.6MB

      • memory/1396-149-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

        Filesize

        180KB

      • memory/1396-150-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/1396-151-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/1396-152-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/1396-153-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-154-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-156-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-158-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-160-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-162-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-164-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-166-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-168-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-170-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-172-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-174-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-176-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-178-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-180-0x00000000048F0000-0x0000000004903000-memory.dmp

        Filesize

        76KB

      • memory/1396-181-0x0000000000400000-0x0000000002B9B000-memory.dmp

        Filesize

        39.6MB

      • memory/1396-182-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/1396-183-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/1396-184-0x0000000007330000-0x0000000007340000-memory.dmp

        Filesize

        64KB

      • memory/1396-186-0x0000000000400000-0x0000000002B9B000-memory.dmp

        Filesize

        39.6MB

      • memory/1812-192-0x0000000007270000-0x0000000007280000-memory.dmp

        Filesize

        64KB

      • memory/1812-191-0x00000000046E0000-0x0000000004726000-memory.dmp

        Filesize

        280KB

      • memory/1812-193-0x0000000007270000-0x0000000007280000-memory.dmp

        Filesize

        64KB

      • memory/1812-194-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-195-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-197-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-199-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-201-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-203-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-205-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-207-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-209-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-211-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-213-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-215-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-217-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-219-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-221-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-223-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-225-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-227-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1812-246-0x0000000007270000-0x0000000007280000-memory.dmp

        Filesize

        64KB

      • memory/1812-987-0x0000000009CB0000-0x000000000A2C8000-memory.dmp

        Filesize

        6.1MB

      • memory/1812-988-0x000000000A300000-0x000000000A312000-memory.dmp

        Filesize

        72KB

      • memory/1812-989-0x000000000A320000-0x000000000A42A000-memory.dmp

        Filesize

        1.0MB

      • memory/1812-990-0x000000000A440000-0x000000000A47C000-memory.dmp

        Filesize

        240KB

      • memory/1812-991-0x0000000007270000-0x0000000007280000-memory.dmp

        Filesize

        64KB

      • memory/1812-992-0x000000000A740000-0x000000000A7A6000-memory.dmp

        Filesize

        408KB

      • memory/1812-993-0x000000000AE10000-0x000000000AEA2000-memory.dmp

        Filesize

        584KB

      • memory/1812-994-0x000000000AFD0000-0x000000000B046000-memory.dmp

        Filesize

        472KB

      • memory/1812-995-0x000000000B080000-0x000000000B09E000-memory.dmp

        Filesize

        120KB

      • memory/1812-996-0x000000000B3A0000-0x000000000B562000-memory.dmp

        Filesize

        1.8MB

      • memory/1812-997-0x000000000B570000-0x000000000BA9C000-memory.dmp

        Filesize

        5.2MB

      • memory/1812-998-0x0000000004A80000-0x0000000004AD0000-memory.dmp

        Filesize

        320KB

      • memory/2252-1004-0x0000000000150000-0x0000000000178000-memory.dmp

        Filesize

        160KB

      • memory/2252-1005-0x0000000006F70000-0x0000000006F80000-memory.dmp

        Filesize

        64KB