Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2023, 06:20
Static task
static1
Behavioral task
behavioral1
Sample
7d7356c0cfb9265b7e61bd38a99f68c7.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
7d7356c0cfb9265b7e61bd38a99f68c7.exe
Resource
win10v2004-20230703-en
General
-
Target
7d7356c0cfb9265b7e61bd38a99f68c7.exe
-
Size
219KB
-
MD5
7d7356c0cfb9265b7e61bd38a99f68c7
-
SHA1
007c599c04fe7b75911e24c6cfbccd768350fca7
-
SHA256
bcd079ed77301cc5f6a0443ccb3c5b4fe4a4b660ad61d5bcc40f0224c8c2da63
-
SHA512
b4025037ac51b0ee94c77ffcd8a7d26f79d15da9029c3b5dec727d4d310fcb69681e7722d3ec171b469a5ad39f092322e9faf803701d45202809e73e1863dea4
-
SSDEEP
3072:IahKyd2n31n5GWp1icKAArDZz4N9GhbkrNEk1GI8YyelYW+XgE4HfQUT:IahOnp0yN90QEW8LmmlWfQ4
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1492 coverperform.exe 1536 coverperform.exe 780 coverperform.exe 4812 coverperfform.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 7d7356c0cfb9265b7e61bd38a99f68c7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7d7356c0cfb9265b7e61bd38a99f68c7.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1492 set thread context of 780 1492 coverperform.exe 92 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1492 coverperform.exe 1492 coverperform.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1492 coverperform.exe Token: SeDebugPrivilege 4812 coverperfform.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1492 2988 7d7356c0cfb9265b7e61bd38a99f68c7.exe 84 PID 2988 wrote to memory of 1492 2988 7d7356c0cfb9265b7e61bd38a99f68c7.exe 84 PID 2988 wrote to memory of 1492 2988 7d7356c0cfb9265b7e61bd38a99f68c7.exe 84 PID 1492 wrote to memory of 1536 1492 coverperform.exe 91 PID 1492 wrote to memory of 1536 1492 coverperform.exe 91 PID 1492 wrote to memory of 1536 1492 coverperform.exe 91 PID 1492 wrote to memory of 780 1492 coverperform.exe 92 PID 1492 wrote to memory of 780 1492 coverperform.exe 92 PID 1492 wrote to memory of 780 1492 coverperform.exe 92 PID 1492 wrote to memory of 780 1492 coverperform.exe 92 PID 1492 wrote to memory of 780 1492 coverperform.exe 92 PID 1492 wrote to memory of 780 1492 coverperform.exe 92 PID 1492 wrote to memory of 780 1492 coverperform.exe 92 PID 1492 wrote to memory of 780 1492 coverperform.exe 92 PID 1492 wrote to memory of 780 1492 coverperform.exe 92 PID 2988 wrote to memory of 4812 2988 7d7356c0cfb9265b7e61bd38a99f68c7.exe 93 PID 2988 wrote to memory of 4812 2988 7d7356c0cfb9265b7e61bd38a99f68c7.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d7356c0cfb9265b7e61bd38a99f68c7.exe"C:\Users\Admin\AppData\Local\Temp\7d7356c0cfb9265b7e61bd38a99f68c7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperform.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperform.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperform.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperform.exe3⤵
- Executes dropped EXE
PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperform.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperform.exe3⤵
- Executes dropped EXE
PID:780
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperfform.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperfform.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD51757b9f574145cc181b66612fe63651d
SHA1b4f454f9015896350ca20cef276ec88f542dbe92
SHA256571cf625b13f331f58fbdf6848336ad4c7bac65ca9409d6c6c1bebcc366e70de
SHA512ae2bf4e89b91cc83448b8bbf284df91731f2a165751d89bd5fab787491acb288ba2c631e1eeedc22316b7ba5ba01766a4b8f67320620b021a89581e3fd55b1a7
-
Filesize
95KB
MD51757b9f574145cc181b66612fe63651d
SHA1b4f454f9015896350ca20cef276ec88f542dbe92
SHA256571cf625b13f331f58fbdf6848336ad4c7bac65ca9409d6c6c1bebcc366e70de
SHA512ae2bf4e89b91cc83448b8bbf284df91731f2a165751d89bd5fab787491acb288ba2c631e1eeedc22316b7ba5ba01766a4b8f67320620b021a89581e3fd55b1a7
-
Filesize
96KB
MD5c37c6ac81e9c30c498df277fa543df08
SHA1a4d7e3b23d3ad93f9767f76029d9828c6fa7e8b6
SHA256d06fb3c9f02e16771a6a4d4b37c4683d5afaf2ed4c0121e195bdc9eef953a074
SHA5127300193cf0df0be98c084b8f2fdec89f529ee94d71c99c537ef8d4bd6d3e97dd089b41e9e73527ebbf87f3fefaa3de7bee1eaf9fea064386f094524d541c11c2
-
Filesize
96KB
MD5c37c6ac81e9c30c498df277fa543df08
SHA1a4d7e3b23d3ad93f9767f76029d9828c6fa7e8b6
SHA256d06fb3c9f02e16771a6a4d4b37c4683d5afaf2ed4c0121e195bdc9eef953a074
SHA5127300193cf0df0be98c084b8f2fdec89f529ee94d71c99c537ef8d4bd6d3e97dd089b41e9e73527ebbf87f3fefaa3de7bee1eaf9fea064386f094524d541c11c2
-
Filesize
96KB
MD5c37c6ac81e9c30c498df277fa543df08
SHA1a4d7e3b23d3ad93f9767f76029d9828c6fa7e8b6
SHA256d06fb3c9f02e16771a6a4d4b37c4683d5afaf2ed4c0121e195bdc9eef953a074
SHA5127300193cf0df0be98c084b8f2fdec89f529ee94d71c99c537ef8d4bd6d3e97dd089b41e9e73527ebbf87f3fefaa3de7bee1eaf9fea064386f094524d541c11c2
-
Filesize
96KB
MD5c37c6ac81e9c30c498df277fa543df08
SHA1a4d7e3b23d3ad93f9767f76029d9828c6fa7e8b6
SHA256d06fb3c9f02e16771a6a4d4b37c4683d5afaf2ed4c0121e195bdc9eef953a074
SHA5127300193cf0df0be98c084b8f2fdec89f529ee94d71c99c537ef8d4bd6d3e97dd089b41e9e73527ebbf87f3fefaa3de7bee1eaf9fea064386f094524d541c11c2