Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2023, 16:08

General

  • Target

    e2b22c7e6a61834361d49697274d8cb3.exe

  • Size

    3.6MB

  • MD5

    e2b22c7e6a61834361d49697274d8cb3

  • SHA1

    756cc64ff7b028542d41e747d55d0e540c61ae46

  • SHA256

    c151884ac7e723b223f637c64a4e352b7439f0d37099327e800959dd062d14e0

  • SHA512

    3e567dea239a1fc93bf70926cb3a74da785af4d8725fbdd553dc8d58ebb7980ebd9812b1c3b78da8eeedbb5a0c78bcf721383c93a029e0aa674f56386e977932

  • SSDEEP

    98304:LKFiM/xFnow/acBwC8oIBxnUl/nhJ/MJMiWq1M2xCSBcDE:LKF5ZmwC4iNUlv+JW4Me0

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2b22c7e6a61834361d49697274d8cb3.exe
    "C:\Users\Admin\AppData\Local\Temp\e2b22c7e6a61834361d49697274d8cb3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4448
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:468
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Users\Admin\AppData\Local\Temp\discordgrabberdataalert.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3476
      • C:\Users\Admin\AppData\Local\Temp\discordgrabberdataalert.exe
        C:\Users\Admin\AppData\Local\Temp\discordgrabberdataalert.exe
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tfcfd.vbs"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4460
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Users\Admin\AppData\Local\Temp\DiscordGrabber.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:556
  • C:\Users\Admin\AppData\Local\Temp\DiscordGrabber.exe
    C:\Users\Admin\AppData\Local\Temp\DiscordGrabber.exe
    1⤵
    • Executes dropped EXE
    PID:4700
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3040

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          47339868d6b1e248b7b203c63af7f686

          SHA1

          c6a428fad02bf4856683d7314f5bf5e692809f69

          SHA256

          a18504c585b1fa84f3c4f7f40d6b77101c59f135efb350368da8fdd3d3879739

          SHA512

          c7e499aecfd42a7548c9b596b5f37c1c5dae06d398645abed463831d439d6189e6b76303741a065007ccf453a5614cbf28b3e2219b85bb7e608ebef3a2a6416a

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          12KB

          MD5

          a72fd299e59ad4aafcf8fe177901630d

          SHA1

          bdbde2a69c1ac8ebd0a83fbd99ec0c40aafd147a

          SHA256

          d9da98a8e8aba6179d86d3f518b31a022241684d407830ce544652a1ea22096a

          SHA512

          50437ab68f0674c0e5ff221dda40437102cdc10912aea2232e40d39ee8ae664db749b5809752817221a5f211dd4b3c0a45782ca71ae0d564d5e05c5fdea0c462

        • C:\Users\Admin\AppData\Local\Temp\DiscordGrabber.exe

          Filesize

          86KB

          MD5

          3918a913e66245ecd633914cf6bf8787

          SHA1

          308781490cb78254e141dfeb8fbbf200034d130f

          SHA256

          85fb4aedcdc160f7b678b5a25e37509bc04c6f85842a424aa329ef069c58922b

          SHA512

          b3a1a0f1efe70955699b638a707bc02d618b3981f5c10a2e372b810b0cbc0474ef4ce171df49f62321402e0f7193a43f240b830e3867092561e8a17b2fed9a19

        • C:\Users\Admin\AppData\Local\Temp\DiscordGrabber.exe

          Filesize

          148KB

          MD5

          40f103c0b1ae2a324c9603952e402d39

          SHA1

          70ee62e1b444534d379670db3a1729f4bdee5b98

          SHA256

          fe1334213e9e0fa8d2d0c8c28ff587e5cde8233e30e7175cb41cd7e33fb03369

          SHA512

          a798854ec4c54102a593b09a7c6ee6dd205ea10cb1733d2dc36e336e7f4c21a9fe8f472a0c6e9738f4c00a973eafef962d2ea0d18637a35aa67837e8a20dc81e

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ewxxqoau.emk.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\discordgrabberdataalert.exe

          Filesize

          154KB

          MD5

          71f5dc81a150a7e645e3e7ab4b84fc20

          SHA1

          f1d1d7f83c310d24d7f00454fab118b1cb4e6507

          SHA256

          0a4c57c281745b1bbec33b17cf481124e34c7c960dc1e867f5390b3edb273963

          SHA512

          27a4af11b865c8b8f39e4dfea32b864cf672938d99499da18fcff12ea647d475abe4cf4c03e3e3a95e9ae7b964ae372754c83aebf654db40b9a20984f40eba82

        • C:\Users\Admin\AppData\Local\Temp\discordgrabberdataalert.exe

          Filesize

          266KB

          MD5

          c4552a772dc60787a049c358a68d3eb8

          SHA1

          a321d3b31646b2d622e494211db30ef2f0d074e3

          SHA256

          710564d854f80216ea45de04154c7dfdecd981e56e92c87ba2a245739eadb5a6

          SHA512

          7393214bba04dc9027144148b84f41c9bf0221e06c325ed9b9e2235f691d3391abb7c7482bc6d3b09d04629f96a9ecf2b6e5ae81ca7f449fd455efc4942bd284

        • C:\Users\Admin\AppData\Local\Temp\tfcfd.vbs

          Filesize

          92B

          MD5

          4b13abd262e6f452b680b7c404285a32

          SHA1

          a5b55774c48678a82ab377a7d23a00ec6a174dea

          SHA256

          e09b4b2ffbca61fbfaa017d9a6c7c60ec4242bfc468bf2f58887e79c97966eff

          SHA512

          8dc590452e549d1dbb582e6552e5cfe960adeb43987435b67d6d1f18d3ff44e7be01f638a7f62f7f47da561303fdc5203ca4412639662f170b6e0022e3ae6bc8

        • memory/468-79-0x0000000070A50000-0x0000000070A9C000-memory.dmp

          Filesize

          304KB

        • memory/468-64-0x00000000046B0000-0x00000000046C0000-memory.dmp

          Filesize

          64KB

        • memory/468-71-0x00000000054D0000-0x0000000005824000-memory.dmp

          Filesize

          3.3MB

        • memory/468-78-0x000000007FB60000-0x000000007FB70000-memory.dmp

          Filesize

          64KB

        • memory/468-65-0x00000000046B0000-0x00000000046C0000-memory.dmp

          Filesize

          64KB

        • memory/468-63-0x0000000074C30000-0x00000000753E0000-memory.dmp

          Filesize

          7.7MB

        • memory/468-90-0x0000000074C30000-0x00000000753E0000-memory.dmp

          Filesize

          7.7MB

        • memory/2040-119-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-109-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-561-0x0000000003BF0000-0x0000000003C00000-memory.dmp

          Filesize

          64KB

        • memory/2040-6-0x0000000000FD0000-0x000000000104A000-memory.dmp

          Filesize

          488KB

        • memory/2040-533-0x000000001E190000-0x000000001E1E2000-memory.dmp

          Filesize

          328KB

        • memory/2040-534-0x0000000003BC0000-0x0000000003BCC000-memory.dmp

          Filesize

          48KB

        • memory/2040-536-0x000000001E230000-0x000000001E27C000-memory.dmp

          Filesize

          304KB

        • memory/2040-535-0x000000001E1E0000-0x000000001E234000-memory.dmp

          Filesize

          336KB

        • memory/2040-94-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-95-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-97-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-99-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-101-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-103-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-107-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-111-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-113-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-115-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-117-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-9-0x00007FFB79C00000-0x00007FFB7A6C1000-memory.dmp

          Filesize

          10.8MB

        • memory/2040-121-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-123-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-125-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-129-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-131-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-72-0x00007FFB79C00000-0x00007FFB7A6C1000-memory.dmp

          Filesize

          10.8MB

        • memory/2040-133-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-135-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-137-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-139-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-141-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-143-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-147-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-149-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-92-0x000000001CB00000-0x000000001CB8A000-memory.dmp

          Filesize

          552KB

        • memory/2040-93-0x0000000003BF0000-0x0000000003C00000-memory.dmp

          Filesize

          64KB

        • memory/2040-105-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-127-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-145-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-157-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-155-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-153-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/2040-151-0x000000001CB00000-0x000000001CB85000-memory.dmp

          Filesize

          532KB

        • memory/3040-555-0x0000021CE35F0000-0x0000021CE3600000-memory.dmp

          Filesize

          64KB

        • memory/3040-548-0x0000021CE3FE0000-0x0000021CE4002000-memory.dmp

          Filesize

          136KB

        • memory/3040-559-0x00007FFB79C00000-0x00007FFB7A6C1000-memory.dmp

          Filesize

          10.8MB

        • memory/3040-553-0x00007FFB79C00000-0x00007FFB7A6C1000-memory.dmp

          Filesize

          10.8MB

        • memory/3040-554-0x0000021CE35F0000-0x0000021CE3600000-memory.dmp

          Filesize

          64KB

        • memory/4448-30-0x0000000005B10000-0x0000000005B5C000-memory.dmp

          Filesize

          304KB

        • memory/4448-51-0x0000000006E00000-0x0000000006E1A000-memory.dmp

          Filesize

          104KB

        • memory/4448-16-0x0000000005240000-0x0000000005262000-memory.dmp

          Filesize

          136KB

        • memory/4448-17-0x00000000053E0000-0x0000000005446000-memory.dmp

          Filesize

          408KB

        • memory/4448-23-0x00000000054C0000-0x0000000005526000-memory.dmp

          Filesize

          408KB

        • memory/4448-28-0x0000000005720000-0x0000000005A74000-memory.dmp

          Filesize

          3.3MB

        • memory/4448-56-0x0000000007050000-0x0000000007064000-memory.dmp

          Filesize

          80KB

        • memory/4448-57-0x0000000007130000-0x000000000714A000-memory.dmp

          Filesize

          104KB

        • memory/4448-58-0x0000000007080000-0x0000000007088000-memory.dmp

          Filesize

          32KB

        • memory/4448-55-0x0000000007040000-0x000000000704E000-memory.dmp

          Filesize

          56KB

        • memory/4448-54-0x0000000007000000-0x0000000007011000-memory.dmp

          Filesize

          68KB

        • memory/4448-35-0x000000007F6D0000-0x000000007F6E0000-memory.dmp

          Filesize

          64KB

        • memory/4448-53-0x0000000007090000-0x0000000007126000-memory.dmp

          Filesize

          600KB

        • memory/4448-11-0x0000000002530000-0x0000000002566000-memory.dmp

          Filesize

          216KB

        • memory/4448-36-0x00000000060B0000-0x00000000060E2000-memory.dmp

          Filesize

          200KB

        • memory/4448-52-0x0000000006E70000-0x0000000006E7A000-memory.dmp

          Filesize

          40KB

        • memory/4448-50-0x0000000007440000-0x0000000007ABA000-memory.dmp

          Filesize

          6.5MB

        • memory/4448-12-0x0000000074B90000-0x0000000075340000-memory.dmp

          Filesize

          7.7MB

        • memory/4448-37-0x0000000070A50000-0x0000000070A9C000-memory.dmp

          Filesize

          304KB

        • memory/4448-47-0x0000000006070000-0x000000000608E000-memory.dmp

          Filesize

          120KB

        • memory/4448-49-0x0000000006CA0000-0x0000000006D43000-memory.dmp

          Filesize

          652KB

        • memory/4448-48-0x00000000024E0000-0x00000000024F0000-memory.dmp

          Filesize

          64KB

        • memory/4448-13-0x0000000004BE0000-0x0000000005208000-memory.dmp

          Filesize

          6.2MB

        • memory/4448-61-0x0000000074B90000-0x0000000075340000-memory.dmp

          Filesize

          7.7MB

        • memory/4448-14-0x00000000024E0000-0x00000000024F0000-memory.dmp

          Filesize

          64KB

        • memory/4448-29-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

          Filesize

          120KB

        • memory/4700-10-0x000002D3F4CB0000-0x000002D3F54AA000-memory.dmp

          Filesize

          8.0MB

        • memory/4700-532-0x000002D3F7A60000-0x000002D3F7A70000-memory.dmp

          Filesize

          64KB

        • memory/4700-32-0x000002D3F5850000-0x000002D3F5851000-memory.dmp

          Filesize

          4KB

        • memory/4700-33-0x000002D3F7A60000-0x000002D3F7A70000-memory.dmp

          Filesize

          64KB

        • memory/4700-34-0x000002D3F7AA0000-0x000002D3F7D08000-memory.dmp

          Filesize

          2.4MB

        • memory/4700-15-0x00007FFB79C00000-0x00007FFB7A6C1000-memory.dmp

          Filesize

          10.8MB

        • memory/4700-91-0x00007FFB79C00000-0x00007FFB7A6C1000-memory.dmp

          Filesize

          10.8MB

        • memory/4700-31-0x000002D3F5850000-0x000002D3F5851000-memory.dmp

          Filesize

          4KB