purelogstealer | 5a7757d1d3fb70c2e261e3e3a14a6c79d0451b3bd67b262059ca001f9c48b308

Analysis

max time kernel
188s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EngineChromium.msi
Size 34.3MB
Sample240426-msdrmsef83
SHA256 5a7757d1d3fb70c2e261e3e3a14a6c79d0451b3bd67b262059ca001f9c48b308
MD5 a74cc7b62eaed6394bdc89f8ae24ae45
SHA1 c0bc2eb10ef1e9891a5f1587cf180a67ac3a72a6
SHA512 a8962c92d0ea8e24f3a98e6fd01c3eedf708dcd4ff54724cd7a4e35d673ccae3f21c1094834ae44486ad785f8905dc975fd31093cf9454f34a0eb85b5331ca9f
SSDEEP 786432:CUz141w/2wmggH4vdjpi6TeQHnjAGVRZ4U2XCUydEB6msg:CUZjXmggOdov8nkGVeXCUIEWg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogstealer redline zgrat newhope2 discovery infostealer persistence rat stealer

Malware Config

Extracted

Family

redline

Botnet

newhope2

91.92.246.148:3362

Signatures

Detect ZGRat V1 35 IoCs

resource	yara_rule
behavioral1/memory/1732-106-0x00000000024A0000-0x0000000002554000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-118-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-170-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-168-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-166-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-164-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-162-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-160-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-158-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-156-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-154-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-152-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-150-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-148-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-146-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-144-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-142-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-140-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-138-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-136-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-134-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-132-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-130-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-128-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-126-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-124-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-122-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-120-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-116-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-114-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-112-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-110-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-108-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1732-107-0x00000000024A0000-0x000000000254D000-memory.dmp	family_zgrat_v1
behavioral1/memory/1700-1073-0x0000000005590000-0x00000000056BA000-memory.dmp	family_zgrat_v1

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000e000000018689-102.dat	family_purelog_stealer
behavioral1/memory/1732-103-0x0000000000EC0000-0x0000000000F94000-memory.dmp	family_purelog_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/1356-1064-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2364	ICACLS.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	costcodeproresieres.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	costcodeprores.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1356	1732	costcode.exe	46

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f763e29.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F13.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\f763e29.msi	msiexec.exe
File created	C:\Windows\Installer\f763e2a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 4 IoCs

pid	Process
1944	costcodeproresieres.exe
2324	costcodeprores.exe
1732	costcode.exe
1700	probablyprogram.exe

Loads dropped DLL 10 IoCs

pid	Process
2816	MsiExec.exe
2816	MsiExec.exe
2816	MsiExec.exe
2816	MsiExec.exe
2816	MsiExec.exe
1944	costcodeproresieres.exe
1944	costcodeproresieres.exe
2324	costcodeprores.exe
1732	costcode.exe
1700	probablyprogram.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	1356	WerFault.exe	46

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2580	msiexec.exe
2580	msiexec.exe
972	powershell.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2844	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2844	msiexec.exe
Token: SeRestorePrivilege	2580	msiexec.exe
Token: SeTakeOwnershipPrivilege	2580	msiexec.exe
Token: SeSecurityPrivilege	2580	msiexec.exe
Token: SeCreateTokenPrivilege	2844	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2844	msiexec.exe
Token: SeLockMemoryPrivilege	2844	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2844	msiexec.exe
Token: SeMachineAccountPrivilege	2844	msiexec.exe
Token: SeTcbPrivilege	2844	msiexec.exe
Token: SeSecurityPrivilege	2844	msiexec.exe
Token: SeTakeOwnershipPrivilege	2844	msiexec.exe
Token: SeLoadDriverPrivilege	2844	msiexec.exe
Token: SeSystemProfilePrivilege	2844	msiexec.exe
Token: SeSystemtimePrivilege	2844	msiexec.exe
Token: SeProfSingleProcessPrivilege	2844	msiexec.exe
Token: SeIncBasePriorityPrivilege	2844	msiexec.exe
Token: SeCreatePagefilePrivilege	2844	msiexec.exe
Token: SeCreatePermanentPrivilege	2844	msiexec.exe
Token: SeBackupPrivilege	2844	msiexec.exe
Token: SeRestorePrivilege	2844	msiexec.exe
Token: SeShutdownPrivilege	2844	msiexec.exe
Token: SeDebugPrivilege	2844	msiexec.exe
Token: SeAuditPrivilege	2844	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2844	msiexec.exe
Token: SeChangeNotifyPrivilege	2844	msiexec.exe
Token: SeRemoteShutdownPrivilege	2844	msiexec.exe
Token: SeUndockPrivilege	2844	msiexec.exe
Token: SeSyncAgentPrivilege	2844	msiexec.exe
Token: SeEnableDelegationPrivilege	2844	msiexec.exe
Token: SeManageVolumePrivilege	2844	msiexec.exe
Token: SeImpersonatePrivilege	2844	msiexec.exe
Token: SeCreateGlobalPrivilege	2844	msiexec.exe
Token: SeBackupPrivilege	2688	vssvc.exe
Token: SeRestorePrivilege	2688	vssvc.exe
Token: SeAuditPrivilege	2688	vssvc.exe
Token: SeBackupPrivilege	2580	msiexec.exe
Token: SeRestorePrivilege	2580	msiexec.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeLoadDriverPrivilege	2548	DrvInst.exe
Token: SeLoadDriverPrivilege	2548	DrvInst.exe
Token: SeLoadDriverPrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2580	msiexec.exe
Token: SeTakeOwnershipPrivilege	2580	msiexec.exe
Token: SeRestorePrivilege	2580	msiexec.exe
Token: SeTakeOwnershipPrivilege	2580	msiexec.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	1732	costcode.exe
Token: SeDebugPrivilege	1700	probablyprogram.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2816	2580	msiexec.exe	32
PID 2580 wrote to memory of 2816	2580	msiexec.exe	32
PID 2580 wrote to memory of 2816	2580	msiexec.exe	32
PID 2580 wrote to memory of 2816	2580	msiexec.exe	32
PID 2580 wrote to memory of 2816	2580	msiexec.exe	32
PID 2580 wrote to memory of 2816	2580	msiexec.exe	32
PID 2580 wrote to memory of 2816	2580	msiexec.exe	32
PID 2816 wrote to memory of 2364	2816	MsiExec.exe	33
PID 2816 wrote to memory of 2364	2816	MsiExec.exe	33
PID 2816 wrote to memory of 2364	2816	MsiExec.exe	33
PID 2816 wrote to memory of 2364	2816	MsiExec.exe	33
PID 2816 wrote to memory of 856	2816	MsiExec.exe	35
PID 2816 wrote to memory of 856	2816	MsiExec.exe	35
PID 2816 wrote to memory of 856	2816	MsiExec.exe	35
PID 2816 wrote to memory of 856	2816	MsiExec.exe	35
PID 2816 wrote to memory of 1944	2816	MsiExec.exe	37
PID 2816 wrote to memory of 1944	2816	MsiExec.exe	37
PID 2816 wrote to memory of 1944	2816	MsiExec.exe	37
PID 2816 wrote to memory of 1944	2816	MsiExec.exe	37
PID 2816 wrote to memory of 1944	2816	MsiExec.exe	37
PID 2816 wrote to memory of 1944	2816	MsiExec.exe	37
PID 2816 wrote to memory of 1944	2816	MsiExec.exe	37
PID 1944 wrote to memory of 656	1944	costcodeproresieres.exe	38
PID 1944 wrote to memory of 656	1944	costcodeproresieres.exe	38
PID 1944 wrote to memory of 656	1944	costcodeproresieres.exe	38
PID 1944 wrote to memory of 656	1944	costcodeproresieres.exe	38
PID 1944 wrote to memory of 656	1944	costcodeproresieres.exe	38
PID 1944 wrote to memory of 656	1944	costcodeproresieres.exe	38
PID 1944 wrote to memory of 656	1944	costcodeproresieres.exe	38
PID 656 wrote to memory of 972	656	cmd.exe	40
PID 656 wrote to memory of 972	656	cmd.exe	40
PID 656 wrote to memory of 972	656	cmd.exe	40
PID 656 wrote to memory of 972	656	cmd.exe	40
PID 656 wrote to memory of 972	656	cmd.exe	40
PID 656 wrote to memory of 972	656	cmd.exe	40
PID 656 wrote to memory of 972	656	cmd.exe	40
PID 1944 wrote to memory of 2324	1944	costcodeproresieres.exe	41
PID 1944 wrote to memory of 2324	1944	costcodeproresieres.exe	41
PID 1944 wrote to memory of 2324	1944	costcodeproresieres.exe	41
PID 1944 wrote to memory of 2324	1944	costcodeproresieres.exe	41
PID 1944 wrote to memory of 2324	1944	costcodeproresieres.exe	41
PID 1944 wrote to memory of 2324	1944	costcodeproresieres.exe	41
PID 1944 wrote to memory of 2324	1944	costcodeproresieres.exe	41
PID 2324 wrote to memory of 1732	2324	costcodeprores.exe	42
PID 2324 wrote to memory of 1732	2324	costcodeprores.exe	42
PID 2324 wrote to memory of 1732	2324	costcodeprores.exe	42
PID 2324 wrote to memory of 1732	2324	costcodeprores.exe	42
PID 2324 wrote to memory of 1732	2324	costcodeprores.exe	42
PID 2324 wrote to memory of 1732	2324	costcodeprores.exe	42
PID 2324 wrote to memory of 1732	2324	costcodeprores.exe	42
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 1732 wrote to memory of 1356	1732	costcode.exe	46
PID 2324 wrote to memory of 1700	2324	costcodeprores.exe	47
PID 2324 wrote to memory of 1700	2324	costcodeprores.exe	47

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EngineChromium.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2844

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E0E31D781D471151BA457C2D9D0A5D0
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-3ca32e5f-f26f-47c0-ae1a-278c4cb163dd\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:2364
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\MW-3ca32e5f-f26f-47c0-ae1a-278c4cb163dd\files\costcodeproresieres.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-3ca32e5f-f26f-47c0-ae1a-278c4cb163dd\files\costcodeproresieres.exe"
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c costcode.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:656
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcodeprores.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcodeprores.exe
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\costcode.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\costcode.exe
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1732
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 636
        7⤵
        Program crash
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\probablyprogram.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\probablyprogram.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "0000000000000578"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

costcode.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcode.bat
Size 145B
SHA256 a6236e067a745bc082ab9b7ce0b4d7b39816efa191ea2c25baee7a334fa70a2b
MD5 aad2830f24f0808e7fe50b82acdfbdf9
SHA1 53d35b0dd209a10dd4cbf4394cbd3cd64bf758be
SHA512 4b30f274012064bac12fd88289f16a592328bec99557d1514f90bdc2402e9a790badd0fed116734fd6dc4654f2e7d0b681d9aff506781e7407a68312a983cd1f
MD5 SHA1 SHA512

Submit Download

probablyprogram.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\probablyprogram.exe
Size 1.3MB
SHA256 fc8100e9dbce6a4338a569bf12bfc4497239a781cb7e6cd3f80949ee6675ca1f
MD5 f73d1e0fd9e1300a131861fb367ac7eb
SHA1 82543f273ad9d8ae93bbe3fd4a0063927c505a84
SHA512 e78bf7e274388742bdb7e42305f5290d03da3e51f0d8c355ee79e179c58b2d043efb652e3f35f90255559ffcf97f4a1b7e4f4d9604f7b33f1e404975ee6c8d20
SSDEEP 24576:Km3AYSG9T2uFvG0xqK4B2srUt8Tkj2bRY1F8Lk3FEmDi8HqPG:KwAYSG1vG0YK4IPXOnkVEwMG
MD5 SHA1 SHA512 SSDEEP

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-3ca32e5f-f26f-47c0-ae1a-278c4cb163dd\files.cab
Size 34.0MB
SHA256 3281204875c3905c97d5e918362f749a7c870e263709cf0413ea1dddb4bc9fda
MD5 39eadf22ac87b0b26ba46d10198aa230
SHA1 f91ecff4e43b492d562547c350fff560a72167de
SHA512 b15bc5fdc548e201d8eb57d5283c8e840d9c71ed34fc9b15373c6e4b84bf8d497705f5cbcadb1b93d84d1fb19de8373060f1ad613d9d13f7fb06290bf31bac02
SSDEEP 786432:+Uz141w/2wmggH4vdjpi6TeQHnjAGVRZ4U2XCUydEB6msg:+UZjXmggOdov8nkGVeXCUIEWg
MD5 SHA1 SHA512 SSDEEP

Submit Download

costcodeproresieres.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-3ca32e5f-f26f-47c0-ae1a-278c4cb163dd\files\costcodeproresieres.exe
Size 34.0MB
SHA256 b6f7b366ebeefbf492b25db56e67934f0f5c3d26391348277e58a0351d312301
MD5 13887aee1ef3f47ae357a139360e052f
SHA1 9c5c229bd23f1e82a9c627f192e661716b648090
SHA512 3f593db09613f5d2c3255b604bd74943b918bb66441c3eccc7df11408374d48e1cda0fedefdc3b3fa0b0e49aa9ac319d756e4630176a877b77486d70206491c9
SSDEEP 786432:kDBFyOiA8N/frahgE/Xt2NJPVmElqJbyvpvff6nRXVcR87:kDDX4/frDu9CNm4qJkff6RXn7
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-3ca32e5f-f26f-47c0-ae1a-278c4cb163dd\msiwrapper.ini
Size 404B
SHA256 3ebbcb2bae2b13fa3feb6072bd367d623fb8967e2d17089d73f9fb716ac6fbf4
MD5 27212ede6ff7429548bb3b1cff0ae0fe
SHA1 a8304327f5fe6a5650605224a875c9442ebd01ac
SHA512 8b4988373e57c4d60d47cc7b38a77933dee526773c3de1fc37b3b6127bb31951db3fc4690032714416ad1c69872406cb57b4a9dd8f98dc2b6139edea96d38c10
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-3ca32e5f-f26f-47c0-ae1a-278c4cb163dd\msiwrapper.ini
Size 1KB
SHA256 6d0d82cba1496d7c03a9d278357a590836ef413eefdc31e62692105028c45424
MD5 df3697790e67bf3c1d8d61e3f83c9109
SHA1 54c8ac02a500c613b1b6e4c5f31776b754517a45
SHA512 ee635f966ae074cf4caebe9f75c34a72caa4daf0d037e20f0ffeab01eb7188a63a93fbb4f4cd5fe615610c31dc55ec442cf3e393d1ead6e208c54dfc5fb50ae4
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-3ca32e5f-f26f-47c0-ae1a-278c4cb163dd\msiwrapper.ini
Size 1KB
SHA256 62dee2f9cd23322505544ab547e3c9edb8f6ac368f0468f627e41dbcb0a9ba28
MD5 9f033c8928e61c65ae996d437aa9f1d9
SHA1 da737b771c9be26972d4bec0216896a97c5e92ae
SHA512 1390402c3284f078f84805c4f081c384159ca71e1a1371d96bbf454695c180e87169849021a51e88ab2aa3073517d8fee41f20ffbf71535dd9919d0a66d9f212
MD5 SHA1 SHA512

Submit Download

costcodeprores.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\costcodeprores.exe
Size 42.0MB
SHA256 b32c0a94ae198325d5d78821ab0d526f2e5c6ac00638f5d6aff10d720874d35c
MD5 73bb756b945ac9734b3ea50d583b6da7
SHA1 6184d653cd6b0906267a1874d54d26892685af44
SHA512 8ee8dfee11c7d7415ae2990ad2a2b1067cf90921ed7873f87a151f32119b61fa24aa1ef7c2fb219bb01d3cb047d944c9cac453ba53cfec74184b3066782649fb
SSDEEP 786432:Z/exBF+Bj1Sn61q0NcF+Bj1Sn61q0NcF+Bj1Sn61q0NW:Z/E2BInN0NvBInN0NvBInN0NW
MD5 SHA1 SHA512 SSDEEP

Submit Download

costcode.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\costcode.exe
Size 838KB
SHA256 22df3ecc6bc24b47ca6afb25525bd0c247bdd18a105ae8fa3174176b4c1fcf9c
MD5 688dc2be58e652d1683cd909b92480ff
SHA1 1b0dfe0801762ef89daa2a5e7ff55cc7615b5f81
SHA512 fbf386421bbde29f763a1ad5e9f0d06dda308e5e58528a74ee67ea37f945dc77156b2e5e0522e0a64e6630ac16a555c353b92117217948fa432325f9202fb215
SSDEEP 12288:KdQl4yKAuCSEjhuJ9oDIzcnHYuzwf3tzbwQESM+rSW/Oi07gR2e:KdQlCFCSEkJzmYuiZbEOS6G7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI3F13.tmp

Path \Windows\Installer\MSI3F13.tmp
Size 208KB
SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1356-1064-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/1700-2006-0x00000000056C0000-0x0000000005780000-memory.dmp

Download

memory/1700-1073-0x0000000005590000-0x00000000056BA000-memory.dmp

Download

memory/1700-1072-0x0000000005310000-0x0000000005438000-memory.dmp

Download

memory/1700-1071-0x0000000001200000-0x0000000001328000-memory.dmp

Download

memory/1700-1070-0x0000000001340000-0x000000000148A000-memory.dmp

Download

memory/1732-152-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-134-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-164-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-162-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-160-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-158-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-156-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-154-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-1040-0x00000000052E0000-0x000000000532C000-memory.dmp

Download

memory/1732-1039-0x00000000004F0000-0x000000000053A000-memory.dmp

Download

memory/1732-168-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-150-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-148-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-146-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-144-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-142-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-140-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-138-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-136-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-166-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-132-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-130-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-128-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-126-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-124-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-122-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-120-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-116-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-114-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-112-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-110-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-108-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-170-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-118-0x00000000024A0000-0x000000000254D000-memory.dmp

Download

memory/1732-106-0x00000000024A0000-0x0000000002554000-memory.dmp

Download

memory/1732-105-0x0000000000E00000-0x0000000000EB2000-memory.dmp

Download

memory/1732-104-0x0000000000B60000-0x0000000000C12000-memory.dmp

Download

memory/1732-103-0x0000000000EC0000-0x0000000000F94000-memory.dmp

Download

memory/1732-107-0x00000000024A0000-0x000000000254D000-memory.dmp

Download