Analysis
-
max time kernel
142s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
24-10-2023 19:22
General
-
Target
DRMS Tender No. P500-2023-102.exe
-
Size
935KB
-
MD5
2e450823db1430464efb84f8074cc84f
-
SHA1
88c86734e5de9f22154ca8c55cd141b2068e922f
-
SHA256
50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8fe
-
SHA512
20c2eedba61f776d90636ad6dae668ad9222c5eca9a69437587317321e3116591250b8327fd41079f892ef021fc7d37035dd1fb20617d2c8331fdab376973c2b
-
SSDEEP
24576:UpCvo/Sfhf/+5SxYn89JnMKFpn/9IUI7ighRKA2E4jKk:iX2f/LxYnonMKHn/9K71hRjrq
Malware Config
Signatures
-
PredatorStealer
Predator is a modular stealer written in C#.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DRMS Tender No. P500-2023-102.exe"C:\Users\Admin\AppData\Local\Temp\DRMS Tender No. P500-2023-102.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LUHgPxjH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LUHgPxjH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A9.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DRMS Tender No. P500-2023-102.exe"C:\Users\Admin\AppData\Local\Temp\DRMS Tender No. P500-2023-102.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\Zip.exe"C:\Users\Admin\AppData\Local\Temp\Zip.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
282B
MD59e36cc3537ee9ee1e3b10fa4e761045b
SHA17726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA2564b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
SHA5125f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
-
Filesize
1KB
MD597f61b05790ce3ba5f62579a588e9ceb
SHA16c351eed4ab3cde2a4ec9891b4f6600cc50e69bf
SHA256c106e8c2d97f7c357a894642ec19372eab8dd2aa630b19e58a14cc03c32dd1a1
SHA512d344fd58cba993b46ebec1c9cca8133c1422110d0f11ee2f07a00bec14fa6b62b78aab683d5a082f68f705e760c9180c6364272c08d85be1205941bb27be0259
-
Filesize
1KB
MD550f552079812c825802433893718ff7d
SHA10ba07a1ec9d4a8eb6ee1bc8202e77e66d39ea036
SHA256975e38717fe3a6f4ef20316f521d202ac42650e9847a249c11b58f7689cf2ab4
SHA5120041fa881753c623c7229251a13c8c95af96ac56cb4a207e7cceb21cd6b8c49b9fd557f29920eeeaa1d12c38898efa3425109f1848e7f631e62fc28f3fd51e90
-
Filesize
419KB
MD5a62d3dfc3a0f04aae4a71020c3024ab0
SHA14684144f85a772a0447b9b6b9843366c1a14ac62
SHA256a6e236bec912041e6bb8750b29f5c60a3b90ad797e2873bf0285c7305302b386
SHA512a8f91dd605be3d51e0688a3d94ff2073526a07096b34ae5db1135856704fe1a62c811a856e301c87274f7fd43627c8d9b38d8b271ef3331ae26078a555cdc73d
-
Filesize
315B
MD5c1075f2de6d2365153674d93ff8ea666
SHA152e8b3325eb437fb5bf1804c5a5d6ff00bbafa8a
SHA256337aeed121eb2488c5f5fd60d9b082bf3c3eb2a096b1e4c5e8eb05d6655187fe
SHA5129a5dcb9e6c96b381c5749e6962be5a410a8151d00eb0697f6fb4eda987ab2529e5f98951ab35bb9f66926d7940fc9a56173126cb5b4e142efb7e8a8dfccb841f
-
Filesize
31KB
MD53afd64484a2a34fc34d1155747dd3847
SHA1451e1d878179f6fcfbaf9fa79d9ee8207489748f
SHA256bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9
SHA512d21a519c8867d569e56ac5c93ce861a72f6853e3a959467bf8e8779664f99b5e8be76ad27e078935191c798aea05891960e01d9a0d52e2a33d34ec5a58c00448
-
Filesize
31KB
MD53afd64484a2a34fc34d1155747dd3847
SHA1451e1d878179f6fcfbaf9fa79d9ee8207489748f
SHA256bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9
SHA512d21a519c8867d569e56ac5c93ce861a72f6853e3a959467bf8e8779664f99b5e8be76ad27e078935191c798aea05891960e01d9a0d52e2a33d34ec5a58c00448
-
Filesize
31KB
MD53afd64484a2a34fc34d1155747dd3847
SHA1451e1d878179f6fcfbaf9fa79d9ee8207489748f
SHA256bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9
SHA512d21a519c8867d569e56ac5c93ce861a72f6853e3a959467bf8e8779664f99b5e8be76ad27e078935191c798aea05891960e01d9a0d52e2a33d34ec5a58c00448
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5336a215e11f63a54166daee22678ebc4
SHA1401b9661c3795700965f57582ad144de5ca7cf7b
SHA256c53a570206837e1cdd97a4e3738e69168aac5ddf554d7b72ac1b441ac0544b89
SHA51217b5c459fadb1a2de553dbe2e64eb3c2e5fcfef1a11cf22c68acdc8ed8da55c95b69891ff768cbeced61c86ad1f7062a80f810924b5e75b886d6d7377da0f839
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
808KB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
952KB
-
Filesize
96KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
576KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
344KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
68KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
600KB
-
Filesize
6.5MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
652KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
6.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
64KB
