Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
23-10-2023 10:39
General
-
Target
DRMS Tender No. P500-2023-102.exe
-
Size
935KB
-
MD5
2e450823db1430464efb84f8074cc84f
-
SHA1
88c86734e5de9f22154ca8c55cd141b2068e922f
-
SHA256
50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8fe
-
SHA512
20c2eedba61f776d90636ad6dae668ad9222c5eca9a69437587317321e3116591250b8327fd41079f892ef021fc7d37035dd1fb20617d2c8331fdab376973c2b
-
SSDEEP
24576:UpCvo/Sfhf/+5SxYn89JnMKFpn/9IUI7ighRKA2E4jKk:iX2f/LxYnonMKHn/9K71hRjrq
Malware Config
Signatures
-
PredatorStealer
Predator is a modular stealer written in C#.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DRMS Tender No. P500-2023-102.exe"C:\Users\Admin\AppData\Local\Temp\DRMS Tender No. P500-2023-102.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LUHgPxjH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LUHgPxjH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp19FB.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DRMS Tender No. P500-2023-102.exe"C:\Users\Admin\AppData\Local\Temp\DRMS Tender No. P500-2023-102.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\Zip.exe"C:\Users\Admin\AppData\Local\Temp\Zip.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
143KB
MD5efe4b1c1a920906ebef1f4c877a597c0
SHA1d41f97667f357cc6cee4febd45bdf44f7763c36d
SHA2563355c3bf75444a4acb5d14a38826d586d66e2f7aea56012b39b01ac244d4ed5f
SHA51223b7b3bc516336718d934a1603733638994aab94d4622ffef8c2e58c1f0716ce4b85b92d1be4278de6d3fce80d9be5d31837763bf72c9308b27117696a176657
-
Filesize
282B
MD59e36cc3537ee9ee1e3b10fa4e761045b
SHA17726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA2564b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
SHA5125f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
-
Filesize
1KB
MD58bf48ae9afa472f99274e1e2e3829500
SHA160825ab3e3addc9fe4e270ef13aaa5ac09c543e2
SHA256d2cd7e6f2e40cea6a7a7b3080cbfa95a1ff27ff47c7e40edfa66e46408ad432c
SHA512820fc10e2ea782917f25540712fb094d3016180cce6aec0449205611869e46724e9c06f6e762db70032b23bc6994833e63fd273ff7ec33e7b1591d11c671deaf
-
Filesize
1KB
MD564be4cd29b23ba874d652ea91267aff0
SHA11392188b4c4d039c92815c4160969b4aad90f1cd
SHA2561857e63c7c7a2cd70708b5555fe2f388fd02f1a2df0a3fc62c20b7b366442407
SHA5121574126d2fc62021ed4d7ed863dca72832630ca1131ef3a92526bf545aff2acf122ac37aab1cb512428aa1b87218c08b97b9c512291c3dbccfd380b973922d45
-
Filesize
419KB
MD54a1a2e5d361e69bcd318b75e0e1f7b1a
SHA17ac8847e6b279e335adad8d6efefb57dc7970257
SHA256f685936a7b277180c978425ec4c5ee76077dc64beaed10b963f1eb1d4e72c258
SHA512d163fc79e159baad149a95f0657b60c90d4afc952af7e0e6e53a59b986362a474188bb860a292a8e8596cdef5303e8cfeb08f85641aa1a29c4acd704f8c59dcc
-
Filesize
315B
MD59a996c144c7f0447e92dbb79310aba45
SHA148143258efa5d3cf6f33109160150f4ad89bca13
SHA256a97717e2c26b72b1cdbf8586fe1df1dfdc2b902407636fc731fbf0410c6bd73c
SHA512b580d7a6f599b087fbc932a394b4ed79816ba32c4d30c26a9a485c26e74d4e65c9180ddbcb2850b74a7fb61825df33634b2f51a33c6ed0230d52688731aa0368
-
Filesize
31KB
MD53afd64484a2a34fc34d1155747dd3847
SHA1451e1d878179f6fcfbaf9fa79d9ee8207489748f
SHA256bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9
SHA512d21a519c8867d569e56ac5c93ce861a72f6853e3a959467bf8e8779664f99b5e8be76ad27e078935191c798aea05891960e01d9a0d52e2a33d34ec5a58c00448
-
Filesize
31KB
MD53afd64484a2a34fc34d1155747dd3847
SHA1451e1d878179f6fcfbaf9fa79d9ee8207489748f
SHA256bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9
SHA512d21a519c8867d569e56ac5c93ce861a72f6853e3a959467bf8e8779664f99b5e8be76ad27e078935191c798aea05891960e01d9a0d52e2a33d34ec5a58c00448
-
Filesize
31KB
MD53afd64484a2a34fc34d1155747dd3847
SHA1451e1d878179f6fcfbaf9fa79d9ee8207489748f
SHA256bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9
SHA512d21a519c8867d569e56ac5c93ce861a72f6853e3a959467bf8e8779664f99b5e8be76ad27e078935191c798aea05891960e01d9a0d52e2a33d34ec5a58c00448
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD56499c6664c341fb67962f46ca78375bd
SHA18ff1db72fb64e0ce69544a9fac8e8f1722b9cd57
SHA25610994e11b6141bd61af9aae2417bd3d9520bb916438359d015d5587b3d28da85
SHA51292b7dc77e13d91f577c844ec31bbb0a392c6e7130f08b7289283caeb53dbdb4e9d874c0e8d0a551cc240fa67e1ff86e9b3f4bfe223c9aaab4b815d99c632ef36
-
Filesize
40KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
952KB
-
Filesize
808KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
652KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
1.7MB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
344KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
576KB
-
Filesize
96KB
-
Filesize
64KB
