54a7b1e1ce8468c00de0015f06788b4cc2c0a7cb2ad4b413d7510971fd218d99

General

Target

Device/HarddiskVolume4/soft/Gowri/kine/Setup.exe
Size

4.5MB
MD5

5452e4d4538b5888558031165b6a5cb7
SHA1

3517e72b2c395af4c2756818ae956185a1874d20
SHA256

03a241bb0f4d4be4f8e520278b03fcb63d8f9c987e0c8399360c57414af1d0de
SHA512

dad957ebb67a1ea7ce5de4f55d5218818882529e004e7a3f9b19ad18910995d3e2fdd61fbe17f7dd0d3ceccfba16b2af34b38949f09a25f970fc717aa07e8ce2
SSDEEP

98304:mztryoS4s8mQDzvS55qFGzjJAtDAGfWphkS/vQ8:HoJmQDUEGz1WohkS/vQ8

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2728	Setup.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2728 set thread context of 4200	2728	Setup.exe	102

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4200	RegAsm.exe
4200	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4124	2728	Setup.exe	101
PID 2728 wrote to memory of 4124	2728	Setup.exe	101
PID 2728 wrote to memory of 4124	2728	Setup.exe	101
PID 2728 wrote to memory of 4200	2728	Setup.exe	102
PID 2728 wrote to memory of 4200	2728	Setup.exe	102
PID 2728 wrote to memory of 4200	2728	Setup.exe	102
PID 2728 wrote to memory of 4200	2728	Setup.exe	102
PID 2728 wrote to memory of 4200	2728	Setup.exe	102
PID 2728 wrote to memory of 4200	2728	Setup.exe	102
PID 2728 wrote to memory of 4200	2728	Setup.exe	102
PID 2728 wrote to memory of 4200	2728	Setup.exe	102
PID 2728 wrote to memory of 4200	2728	Setup.exe	102

C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\soft\Gowri\kine\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\soft\Gowri\kine\Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:4124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/2728-16-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/2728-5-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/2728-17-0x0000000005860000-0x0000000005870000-memory.dmp

Filesize
64KB

Download
memory/2728-4-0x00000000055E0000-0x000000000567C000-memory.dmp

Filesize
624KB

Download
memory/2728-18-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/2728-6-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/2728-7-0x0000000005770000-0x000000000577A000-memory.dmp

Filesize
40KB

Download
memory/2728-20-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/2728-9-0x0000000005E20000-0x0000000005FB2000-memory.dmp

Filesize
1.6MB

Download
memory/2728-1-0x0000000000510000-0x0000000000998000-memory.dmp

Filesize
4.5MB

Download
memory/2728-15-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/2728-0-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/2728-3-0x00000000053A0000-0x0000000005432000-memory.dmp

Filesize
584KB

Download
memory/2728-2-0x0000000005870000-0x0000000005E14000-memory.dmp

Filesize
5.6MB

Download
memory/2728-8-0x0000000005780000-0x0000000005788000-memory.dmp

Filesize
32KB

Download
memory/2728-19-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/2728-22-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/2728-21-0x00000000067E0000-0x00000000068E0000-memory.dmp

Filesize
1024KB

Download
memory/2728-23-0x00000000067E0000-0x00000000068E0000-memory.dmp

Filesize
1024KB

Download
memory/2728-24-0x00000000067E0000-0x00000000068E0000-memory.dmp

Filesize
1024KB

Download
memory/2728-30-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/4200-27-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4200-28-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4200-25-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4200-31-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing