Resubmissions

19-01-2022 17:47

220119-wcv6escaf9 10

Analysis

  • max time kernel
    1202s
  • max time network
    1199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-04-2024 13:35

General

  • Target

    15854a76db97918e152cabbd6ff921b7e71af57ea35b6a97e664e85214e0e6e3.exe

  • Size

    434KB

  • MD5

    4336e6751deca7528cb55ab0f180227e

  • SHA1

    c8d4c51628616a8402445d0159f5c2bd220a39ec

  • SHA256

    15854a76db97918e152cabbd6ff921b7e71af57ea35b6a97e664e85214e0e6e3

  • SHA512

    8115f838752c6e5578d6c908b9fd1adf6c246b236e90385ec98ffab1579e5738f17999b1b44affb5a10a6ca96a710a68a86ed3e3098539318071896330b397be

  • SSDEEP

    12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuT:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNbR

Score
10/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff88d9a2e98,0x7ff88d9a2ea4,0x7ff88d9a2eb0
      2⤵
        PID:3460
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3080 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:2
        2⤵
          PID:3936
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3124 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:3
          2⤵
            PID:4116
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
            2⤵
              PID:2760
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5332 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:1
              2⤵
                PID:912
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5552 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:1
                2⤵
                  PID:4420
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
                  2⤵
                    PID:2084
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:3
                    2⤵
                      PID:2060
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:3
                      2⤵
                        PID:1564
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3548 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:3
                        2⤵
                          PID:4984
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
                          2⤵
                            PID:2624
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4236 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:3
                            2⤵
                              PID:4632
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4236 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:3
                              2⤵
                                PID:1936
                            • C:\Users\Admin\AppData\Local\Temp\15854a76db97918e152cabbd6ff921b7e71af57ea35b6a97e664e85214e0e6e3.exe
                              "C:\Users\Admin\AppData\Local\Temp\15854a76db97918e152cabbd6ff921b7e71af57ea35b6a97e664e85214e0e6e3.exe"
                              1⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:4028
                              • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
                                "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:3964

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

                              Filesize

                              44KB

                              MD5

                              8ea98bb0c5ebe89c405654b0c065db06

                              SHA1

                              b89c32aa5f0191e08d01535dbc56bad6f180d27d

                              SHA256

                              c6079c54443e76c2d5acfa80af110f38202e5f1311c2155354a89a9900ef9cc6

                              SHA512

                              549b0da77a6f674464e015a268712d68379fbb8eb8b2e3ea68dca70fbfb69defc2c0b5572cb2c88439743749da75c14d8d2f0d2f0fa72a81aacbc9de3aea8d29

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

                              Filesize

                              264KB

                              MD5

                              8dce87ccdac5222f8ef4a78c694de35c

                              SHA1

                              c61c7594262c58f34c1da066802112ebb7970a02

                              SHA256

                              f30e0e921a25c1af653ad94b74e4afcecea1e3ee4c6e5b3e5db36b16e38b89da

                              SHA512

                              e1510987c562b8bed3b3b1b1976b7fcd9df96dd8b4b0a5e40918fd1854adcff73940edd9bd50d64b06ae9c757732bc9c7754b14020e1cd5137aaa51a75eec2da

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

                              Filesize

                              40B

                              MD5

                              20d4b8fa017a12a108c87f540836e250

                              SHA1

                              1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                              SHA256

                              6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                              SHA512

                              507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              63eec9d41eae17aa2657647d38e55619

                              SHA1

                              04bd4a5eb65b84a6afa990ae8f5d37361824fbff

                              SHA256

                              eeee196140f2f7601c6f0fe03be3dd432265e6c18fcbcdbf0355889158fce596

                              SHA512

                              83653de69b3fe0f4f38012de3b9e202f6c62018d77f476df524e8f8053619877308ab5886741472f06a856241a0310ca77ee691b71363ecac0e2c501c31b3af8

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              36KB

                              MD5

                              d50a20bafb5a57c4be68ce913732ea13

                              SHA1

                              a020f582ecc2fa04700659e18b8bfa95c3f1af94

                              SHA256

                              f22d422adf4586166088802584981727fe2840628545f62409f24b9820182723

                              SHA512

                              d8246d4bb57d65a4bb0a5df6d93f56d38f08b2b319925637cdbe58c24d14ecc393f56069f62c2f9c9c75463ac2afa7a47ac4b27d23c8d7a48a0aaff7f9619430

                            • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

                              Filesize

                              3KB

                              MD5

                              b4cd27f2b37665f51eb9fe685ec1d373

                              SHA1

                              7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

                              SHA256

                              91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

                              SHA512

                              e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

                            • C:\Users\Admin\AppData\Local\Temp\x64btit.txt

                              Filesize

                              28B

                              MD5

                              19eb4a67a8dc35e6f6cefdefa02dc756

                              SHA1

                              68382fa2660fcf8cd203932461d96fe8cb608d22

                              SHA256

                              3501cf2bf5b5338d00bac7b4acfda42253fd1afac5b162ad37e2a278590f9a22

                              SHA512

                              751ed493d6df6cc36ef3aff132b223e8096ff243538debf4944a050e10176ca7cec92f9bab658c1c6c596343ea01f64853f19330266849955bc1db345474166b