eadcf660e731fd3de0a5a8bee2f2337e7d78438f4e9293d2c90d5e63a2d9368e

Resubmissions

26-07-2024 08:19

240726-j7ytkszeqd 3

07-05-2024 20:40

240507-zgaxtseg4v 10

23-04-2024 21:09

240423-zzq2rsca28 7

Analysis

max time kernel
21s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Installer.exe
Size

158.3MB
MD5

ac686947988fb29c074489a28f32fb86
SHA1

4760635ba437216456a0633b41748a63aafdd748
SHA256

69f086ecb0e9b764462e3d62268194b2b9abc8e4492b6c5b38472e1b7897436d
SHA512

b77afc5775edcf3a66d0bc80024530b08c1ccf0adff9d24f66d71eabaedc415d276d6fb95f5c8ac654d3c7d19652b2a12e45f04e4c31c75763c9cb9cff7b15aa
SSDEEP

1572864:TULGtNWpvig2iH72GUrstdzcuo3tSONV9k9KDipAsKjUcX5j+BJwB/dlktdXQIAI:W12uI+

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Installer.exeInstaller.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	Installer.exe

Loads dropped DLL 2 IoCs

Processes:

Installer.exe

pid process

2108 Installer.exe
2108 Installer.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2108	Installer.exe
2108	Installer.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Installer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Installer.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

996 tasklist.exe

pid	process
996	tasklist.exe

Modifies registry class 7 IoCs

Processes:

Installer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\discord-1226551158328262687\URL Protocol	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\discord-1226551158328262687\ = "URL:discord-1226551158328262687"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\discord-1226551158328262687\shell\open\command	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\discord-1226551158328262687\shell	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\discord-1226551158328262687\shell\open	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\discord-1226551158328262687\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Installer.exe\" \"%1\""	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\discord-1226551158328262687	Installer.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

tasklist.exeInstaller.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	996	tasklist.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: SeShutdownPrivilege	2108	Installer.exe
Token: SeCreatePagefilePrivilege	2108	Installer.exe
Token: 33	1880	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1880	AUDIODG.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Installer.execmd.exe

description	pid	process	target process
PID 2108 wrote to memory of 3628	2108	Installer.exe	cmd.exe
PID 2108 wrote to memory of 3628	2108	Installer.exe	cmd.exe
PID 3628 wrote to memory of 996	3628	cmd.exe	tasklist.exe
PID 3628 wrote to memory of 996	3628	cmd.exe	tasklist.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 3764	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 2536	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 2536	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe
PID 2108 wrote to memory of 4680	2108	Installer.exe	Installer.exe

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1880 --field-trial-handle=1884,i,13462453999515807514,13339163156893329204,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
2⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --mojo-platform-channel-handle=2308 --field-trial-handle=1884,i,13462453999515807514,13339163156893329204,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
2⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2544 --field-trial-handle=1884,i,13462453999515807514,13339163156893329204,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
- Checks computer location settings
PID:4680

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --mojo-platform-channel-handle=3588 --field-trial-handle=1884,i,13462453999515807514,13339163156893329204,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
2⤵
PID:2684

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2404 --field-trial-handle=1884,i,13462453999515807514,13339163156893329204,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
2⤵
PID:4788

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x338
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5858a5b8-f93c-40cf-9224-21fde717bc59.tmp.node

Filesize
154KB

MD5
b618595558e9f820af0b9ab0127fe12b

SHA1
d7c1a145b0e111c82cb2fff60f0ec32a7afc1f4e

SHA256
6948c0083facb97c14f947bb68c69a9956232039add4d1ea27f9c1b92b819876

SHA512
bec87b54298240582c6790c2f41ead3582c8a4ad80449f55ba34f0996e55e09e38e6f5d92a06f9a950ef42d68d09f53f6e0eac030e6ee20ddaeab1fde6a22ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\fbfc1e37-4513-4159-8cf2-0171fb2f7253.tmp.node

Filesize
1.8MB

MD5
beb8d911d40e8fe94770d9d341e0de11

SHA1
d24d31e5b44a4a80969e2a669fb9b0ed42cfd479

SHA256
ec41fc2fee2abcbf0559965501f54aae47cff24a87204fd3a85d86c7d53d53c7

SHA512
079c43c2533fa35411247dd091c5caedb4a0dbdeee7b8f9fbbba6f521d760856822d373f1e6682eff10bebc63168cb4a445aee7b23047e4d784ab28891d07bfe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\game\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
5b2fcb265b045fe0c2b2d3a4637668ec

SHA1
b2e6f8715d280d73d41e7b88097698cd2d2682db

SHA256
8554847886353ca67815786f83bbec6ea0f487931cc7dce312a4d3e6cdf2282a

SHA512
8cc04870fc54f8c27f217b3cda6cb9687347b13ce04f1a35c39efd26f6fde9cfae76a9c2863d1d66cbd15cbafc17a4af9853313fe6ef6087cd750d64306504a8

Download Submit
C:\Users\Admin\AppData\Roaming\game\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
461c310d3b48c74c842471f4a7de4bf7

SHA1
56597ad289599856affc743f154219dd4ca8b6bf

SHA256
4adcea2b0b26cc667e4e36691c8b650f86eda74ab7c0b4c55056ee03e860dec2

SHA512
c53d8ad0a75fca775b4b0d45429330f8d9dfb6849bae190dc61aedf1575970fb765dca89880d9ae76eccd5310235f0f684c2352e18d3b5e8febfeb5b627c2558

Download Submit
C:\Users\Admin\AppData\Roaming\game\Network\Network Persistent State

Filesize
567B

MD5
bcbe9db1ef07907a0d23aa5b7403a7ce

SHA1
6990b9e4529c1b3404dbf9931a27b895842f0a43

SHA256
b48e3882644d621f25bba5c244e3c1de043ed2544c1a6cdb62ecfb91d0f5402e

SHA512
126c6b2f91fc261e28db88ba314ed95cab8f7667b617d171fab0dd4432dee7f26dbee1642c323085c9e264d9bbc75619e79431903d147b74020e68f7f74825c9

Download Submit
C:\Users\Admin\AppData\Roaming\game\Network\Network Persistent State~RFe584cb4.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\game\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
memory/2684-117-0x00007FF95ADE0000-0x00007FF95ADE1000-memory.dmp

Filesize
4KB

Download
memory/4680-58-0x00007FF95B060000-0x00007FF95B061000-memory.dmp

Filesize
4KB

Download
memory/4680-57-0x00007FF95B370000-0x00007FF95B371000-memory.dmp

Filesize
4KB

Download
memory/4680-162-0x0000014A8C710000-0x0000014A8C740000-memory.dmp

Filesize
192KB

Download
memory/4788-165-0x000002921B860000-0x000002921B861000-memory.dmp

Filesize
4KB

Download
memory/4788-164-0x000002921B860000-0x000002921B861000-memory.dmp

Filesize
4KB

Download
memory/4788-163-0x000002921B860000-0x000002921B861000-memory.dmp

Filesize
4KB

Download
memory/4788-169-0x000002921B860000-0x000002921B861000-memory.dmp

Filesize
4KB

Download