edca5b156737a2927e74d0475e834240d7a4f4189d6c6116518e4fe0d80527d6

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2023 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chase_Bank_Statement0143121402341.exe
Size

37.4MB
MD5

979701a4ed42815f310887daa902651a
SHA1

f8ea2c518a17f3d2756876c4c592617e355b9b0d
SHA256

edca5b156737a2927e74d0475e834240d7a4f4189d6c6116518e4fe0d80527d6
SHA512

52ec756f7486755cc8df7ca56002da0d91371cab0cc79178926eed334f449a393d84416f2a8b9e517c6b1a69dbc7c194c0b3772a50f0872e42b4526b69cbefa2
SSDEEP

786432:i8eyWzlMKgLrnzcBtWTCzfeXGwGjaC39DIo3:iwrLrzityj3C39v

Score

8^/10

spyware

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	Chase_Bank_Statement0143121402341.exe

Loads dropped DLL 2 IoCs

pid	Process
2868	AddInProcess32.exe
2868	AddInProcess32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 2868	3040	Chase_Bank_Statement0143121402341.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AddInProcess32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AddInProcess32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2136	timeout.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
3040	Chase_Bank_Statement0143121402341.exe
372	powershell.exe
372	powershell.exe
3644	powershell.exe
3644	powershell.exe
2868	AddInProcess32.exe
2868	AddInProcess32.exe
5072	powershell.exe
5072	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	372	powershell.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 372	3040	Chase_Bank_Statement0143121402341.exe	86
PID 3040 wrote to memory of 372	3040	Chase_Bank_Statement0143121402341.exe	86
PID 3040 wrote to memory of 2868	3040	Chase_Bank_Statement0143121402341.exe	89
PID 3040 wrote to memory of 2868	3040	Chase_Bank_Statement0143121402341.exe	89
PID 3040 wrote to memory of 2868	3040	Chase_Bank_Statement0143121402341.exe	89
PID 3040 wrote to memory of 3644	3040	Chase_Bank_Statement0143121402341.exe	90
PID 3040 wrote to memory of 3644	3040	Chase_Bank_Statement0143121402341.exe	90
PID 3040 wrote to memory of 2868	3040	Chase_Bank_Statement0143121402341.exe	89
PID 3040 wrote to memory of 2868	3040	Chase_Bank_Statement0143121402341.exe	89
PID 3040 wrote to memory of 2868	3040	Chase_Bank_Statement0143121402341.exe	89
PID 3040 wrote to memory of 2868	3040	Chase_Bank_Statement0143121402341.exe	89
PID 3040 wrote to memory of 2868	3040	Chase_Bank_Statement0143121402341.exe	89
PID 3040 wrote to memory of 2868	3040	Chase_Bank_Statement0143121402341.exe	89
PID 3040 wrote to memory of 5072	3040	Chase_Bank_Statement0143121402341.exe	95
PID 3040 wrote to memory of 5072	3040	Chase_Bank_Statement0143121402341.exe	95
PID 2868 wrote to memory of 2556	2868	AddInProcess32.exe	96
PID 2868 wrote to memory of 2556	2868	AddInProcess32.exe	96
PID 2868 wrote to memory of 2556	2868	AddInProcess32.exe	96
PID 2556 wrote to memory of 2136	2556	cmd.exe	98
PID 2556 wrote to memory of 2136	2556	cmd.exe	98
PID 2556 wrote to memory of 2136	2556	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\Chase_Bank_Statement0143121402341.exe
"C:\Users\Admin\AppData\Local\Temp\Chase_Bank_Statement0143121402341.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAyADAA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fa43c5d409237063705a8aa3a5868f25

SHA1
7bb83b3ed1aae19408f08cd6df8a53fd038575f8

SHA256
c9c99092d4b96c7ebf347ea548ac9e36c63d06b6e361b1e8c84fac269200ee78

SHA512
865422d5187a87bfbd158c6beae2e996067a0bd82f9fc336c8c26b5e390d2c7ad9634f794a252a2979b6036122eaccec4e56898fdd97d629a1474b8f72bcc1a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2f996b44e71bcf8e9d9bd5ef2a96a963

SHA1
61a10fcfb7bad1271f7132c7491982a916489af0

SHA256
78d612ffa268c2871faf8e656889f9ec6475890ff2763410dbf434a343ad9a0d

SHA512
84815d678a672aa99d4834fa4c0a42089bec36da593caabc337dc66180a8ebd0131e65fb68ba645d3d68e80a5e7808e0dcf5b0ff1cb2a46786d532b088b44515

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_apj1linq.5do.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/372-166-0x00000206EF910000-0x00000206EF932000-memory.dmp

Filesize
136KB

Download
memory/372-173-0x00000206EE9F0000-0x00000206EEA00000-memory.dmp

Filesize
64KB

Download
memory/372-172-0x00000206EE9F0000-0x00000206EEA00000-memory.dmp

Filesize
64KB

Download
memory/2868-193-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2868-192-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2868-190-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/3040-145-0x00007FFEF8EF0000-0x00007FFEF8EF2000-memory.dmp

Filesize
8KB

Download
memory/3040-171-0x000002BC33960000-0x000002BC339E3000-memory.dmp

Filesize
524KB

Download
memory/3040-147-0x00007FFEF8F10000-0x00007FFEF8F12000-memory.dmp

Filesize
8KB

Download
memory/3040-148-0x00007FFEF8F20000-0x00007FFEF8F22000-memory.dmp

Filesize
8KB

Download
memory/3040-149-0x00007FFEF8F30000-0x00007FFEF8F32000-memory.dmp

Filesize
8KB

Download
memory/3040-150-0x00007FFEF8F40000-0x00007FFEF8F42000-memory.dmp

Filesize
8KB

Download
memory/3040-151-0x00007FFEF8F50000-0x00007FFEF8F52000-memory.dmp

Filesize
8KB

Download
memory/3040-152-0x00007FFEF8F60000-0x00007FFEF8F62000-memory.dmp

Filesize
8KB

Download
memory/3040-153-0x00007FFEF8F70000-0x00007FFEF8F72000-memory.dmp

Filesize
8KB

Download
memory/3040-154-0x00007FFEF8F80000-0x00007FFEF8F82000-memory.dmp

Filesize
8KB

Download
memory/3040-155-0x00007FFEF8F90000-0x00007FFEF8F92000-memory.dmp

Filesize
8KB

Download
memory/3040-156-0x00007FFEF8FA0000-0x00007FFEF8FA2000-memory.dmp

Filesize
8KB

Download
memory/3040-157-0x00007FFEF8FB0000-0x00007FFEF8FB2000-memory.dmp

Filesize
8KB

Download
memory/3040-158-0x00007FFEF8FC0000-0x00007FFEF8FC2000-memory.dmp

Filesize
8KB

Download
memory/3040-159-0x00007FF67F8B0000-0x00007FF681E14000-memory.dmp

Filesize
37.4MB

Download
memory/3040-133-0x00007FFEF8E70000-0x00007FFEF8E72000-memory.dmp

Filesize
8KB

Download
memory/3040-144-0x00007FFEF8EE0000-0x00007FFEF8EE2000-memory.dmp

Filesize
8KB

Download
memory/3040-146-0x00007FFEF8F00000-0x00007FFEF8F02000-memory.dmp

Filesize
8KB

Download
memory/3040-143-0x00007FFEF8ED0000-0x00007FFEF8ED2000-memory.dmp

Filesize
8KB

Download
memory/3040-142-0x00007FFEF8EC0000-0x00007FFEF8EC2000-memory.dmp

Filesize
8KB

Download
memory/3040-141-0x00007FFEF8EB0000-0x00007FFEF8EB2000-memory.dmp

Filesize
8KB

Download
memory/3040-140-0x00007FFEF8EA0000-0x00007FFEF8EA2000-memory.dmp

Filesize
8KB

Download
memory/3040-134-0x00007FFEF8E80000-0x00007FFEF8E82000-memory.dmp

Filesize
8KB

Download
memory/3040-135-0x00007FFEF8E90000-0x00007FFEF8E92000-memory.dmp

Filesize
8KB

Download
memory/3040-139-0x00007FFEF6B40000-0x00007FFEF6B42000-memory.dmp

Filesize
8KB

Download
memory/3040-138-0x00007FFEF6B30000-0x00007FFEF6B32000-memory.dmp

Filesize
8KB

Download
memory/3040-137-0x00007FFEF7F00000-0x00007FFEF7F02000-memory.dmp

Filesize
8KB

Download
memory/3040-136-0x00007FFEF7EF0000-0x00007FFEF7EF2000-memory.dmp

Filesize
8KB

Download
memory/3644-188-0x0000013020260000-0x0000013020270000-memory.dmp

Filesize
64KB

Download
memory/3644-187-0x0000013020260000-0x0000013020270000-memory.dmp

Filesize
64KB

Download
memory/5072-254-0x00000141F8660000-0x00000141F8670000-memory.dmp

Filesize
64KB

Download
memory/5072-253-0x00000141F8660000-0x00000141F8670000-memory.dmp

Filesize
64KB

Download
memory/5072-255-0x00000141F8660000-0x00000141F8670000-memory.dmp

Filesize
64KB

Download
memory/5072-272-0x00000141F8660000-0x00000141F8670000-memory.dmp

Filesize
64KB

Download
memory/5072-273-0x00000141F8660000-0x00000141F8670000-memory.dmp

Filesize
64KB

Download
memory/5072-274-0x00000141F8660000-0x00000141F8670000-memory.dmp

Filesize
64KB

Download