Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2024 01:25

General

  • Target

    c94b04f2c1bffdfc3052c8cde5feb96005ca25cf55ea4d30253bf966020f6cdb.exe

  • Size

    45KB

  • MD5

    8ac70aaa6dc9e8b2aa5c43be0f8ba5f2

  • SHA1

    a35ae4ce799229d4fb3956512d1eba0b543dc8bf

  • SHA256

    c94b04f2c1bffdfc3052c8cde5feb96005ca25cf55ea4d30253bf966020f6cdb

  • SHA512

    c0e86cd036e93d3435340f4f980f6c19a3111b5521579b675de1af410438bed0e2fe2b44216daa8a6ce4f23f2f8ea1d7d0b815b66d3e1736b30584e5fdcacd96

  • SSDEEP

    768:gcB0KsewZ7UFRZa9R0wHuOvieuXXgyTXx7xTDkh6W0rt5fLB8J6aL0vBYHiSG0TV:CSEuXXgyzxNS6W0rtdB8JruBYHNG0x

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c94b04f2c1bffdfc3052c8cde5feb96005ca25cf55ea4d30253bf966020f6cdb.exe
    "C:\Users\Admin\AppData\Local\Temp\c94b04f2c1bffdfc3052c8cde5feb96005ca25cf55ea4d30253bf966020f6cdb.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3qikdzx2\3qikdzx2.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53FC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2BCFFBB8FC3142A3A467CF60D98B8E47.TMP"
        3⤵
          PID:4888
      • C:\Users\Admin\AppData\Local\Temp\NFbMAPE.exe
        "C:\Users\Admin\AppData\Local\Temp\NFbMAPE.exe"
        2⤵
        • Executes dropped EXE
        PID:4536

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\NFbMAPE.exe

      Filesize

      9KB

      MD5

      1199030d12ea13d836edfbbebacf706d

      SHA1

      83afec6e941dc1c9392a773c7df0ee5f1d2eac08

      SHA256

      878b00faccdbda0e5ead3bff8d5b9cc5fbf79d2c5a3715bd03590136af31f2b4

      SHA512

      649d13f7dab2efdec896ed88a9f2e4853af8ba8ca471b982c8fdabf3a21c38f83d6cadd6a782d2fabc4f41103e8b0f70245ff4b0129353418301f85c083a2f9c

    • C:\Users\Admin\AppData\Local\Temp\RES53FC.tmp

      Filesize

      1KB

      MD5

      a276b49e0d474d209ccb136a5bd6f2f6

      SHA1

      0b303885c85f08c7f19e66ce91eb415169486530

      SHA256

      ad943516fd410f67076216d69aff9cbb9d0abc6cfa7fbad18278619e87d65c53

      SHA512

      ba2a6735a7b06dcc1865a454fda40217bc76b1c1e602d5ee9cbef8f93f3599eb3dd335d3ca447917f54d4b3e866ee088a832bdf1c40e25d561c570311ba302b9

    • \??\c:\Users\Admin\AppData\Local\Temp\3qikdzx2\3qikdzx2.0.cs

      Filesize

      7KB

      MD5

      f7ce09127bf57f3ca232ce17f9dafe2d

      SHA1

      2ffc33a27685b83269b4285d744f565e037e5413

      SHA256

      975d9eebca817984e2882fb2b72318d526741b417b05b4dc74a3fca616d652ad

      SHA512

      af637364a3a0032320d434ec32fc8a50ae45f5dffaae9783d33ec7039c72c232276737a8bf40f39c30d52970100f69215a48984fa8ff68b03d69abf7e650d368

    • \??\c:\Users\Admin\AppData\Local\Temp\3qikdzx2\3qikdzx2.cmdline

      Filesize

      210B

      MD5

      55187dac39a0e400efb81b7f21c3e065

      SHA1

      ba9a0c995b25047c5be9ad13cfc85bc2935aaba4

      SHA256

      b0684f1f89322298763ea0a848146e4261948eeef2e26fe16f769aa0bf20a43e

      SHA512

      161afb473553553ff6f91494a32282999bcef14c5428c6960ae2f8a9cd87059f6032f3d15328f1d954247b349ca9a2cc3bf0fc3fd75f689e37bde055e4db724b

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC2BCFFBB8FC3142A3A467CF60D98B8E47.TMP

      Filesize

      1KB

      MD5

      201b358b9eba7b67c454b4670fc37bf8

      SHA1

      620fb9bced83450e6f27511b8daa914e6287a427

      SHA256

      173f4b47b48f167c71bd61a75302f144e6ddc1a2e57471ef0883fa2e7352db86

      SHA512

      5c4efef4776125e3c542b22c321f08a7cb17b3a3cf067e595366cd75cce3839643648042f6c6f2dc2a82efadbbb78ddfceb934a24da64d7e6b0d2263146ba010

    • memory/2664-10-0x000002244CBE0000-0x000002244CBF2000-memory.dmp

      Filesize

      72KB

    • memory/2664-0-0x000002244AEC0000-0x000002244AED2000-memory.dmp

      Filesize

      72KB

    • memory/2664-8-0x000002244CC20000-0x000002244CC30000-memory.dmp

      Filesize

      64KB

    • memory/2664-2-0x00007FFF539D0000-0x00007FFF54491000-memory.dmp

      Filesize

      10.8MB

    • memory/2664-1-0x000002244CA40000-0x000002244CA4A000-memory.dmp

      Filesize

      40KB

    • memory/2664-37-0x00000224654A0000-0x00000224655A2000-memory.dmp

      Filesize

      1.0MB

    • memory/2664-38-0x00007FFF539D0000-0x00007FFF54491000-memory.dmp

      Filesize

      10.8MB

    • memory/4536-34-0x00007FFF539D0000-0x00007FFF54491000-memory.dmp

      Filesize

      10.8MB

    • memory/4536-33-0x0000000000610000-0x0000000000618000-memory.dmp

      Filesize

      32KB

    • memory/4536-35-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

      Filesize

      64KB

    • memory/4536-39-0x00007FFF539D0000-0x00007FFF54491000-memory.dmp

      Filesize

      10.8MB

    • memory/4536-40-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

      Filesize

      64KB