d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91

General

Target

d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe
Size

4.3MB
MD5

11863412761ab6f0dadd70d838ac3989
SHA1

5724e78c916f83766cfc219c42beb4948ff3315d
SHA256

d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91
SHA512

1603837c5eea79c4785d1580fa29aaf06ae8ae05377e2ad271ad457675d40315350ee245e9039a241d9def0c068c48159a76fc7fdf7bd154165881ddd900c6e3
SSDEEP

98304:SYVezkr9ZS9RKzQwEk5fhS2drRroeSLo96Dv45rrvUW9AY:S2ezkr9ZSDKzQwEk5fptUeAQpz5

Score

7^/10

spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 96	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	76

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3176	1448	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
96	MsBuild.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	96	MsBuild.exe
Token: SeBackupPrivilege	96	MsBuild.exe
Token: SeSecurityPrivilege	96	MsBuild.exe
Token: SeSecurityPrivilege	96	MsBuild.exe
Token: SeSecurityPrivilege	96	MsBuild.exe
Token: SeSecurityPrivilege	96	MsBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4292	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	73
PID 1448 wrote to memory of 4292	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	73
PID 1448 wrote to memory of 4292	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	73
PID 1448 wrote to memory of 4328	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	74
PID 1448 wrote to memory of 4328	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	74
PID 1448 wrote to memory of 4328	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	74
PID 1448 wrote to memory of 164	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	75
PID 1448 wrote to memory of 164	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	75
PID 1448 wrote to memory of 164	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	75
PID 1448 wrote to memory of 96	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	76
PID 1448 wrote to memory of 96	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	76
PID 1448 wrote to memory of 96	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	76
PID 1448 wrote to memory of 96	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	76
PID 1448 wrote to memory of 96	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	76
PID 1448 wrote to memory of 96	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	76
PID 1448 wrote to memory of 96	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	76
PID 1448 wrote to memory of 96	1448	d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe	76

C:\Users\Admin\AppData\Local\Temp\d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe
"C:\Users\Admin\AppData\Local\Temp\d12d4da3bab8a93ef31a5b25384c5e700299bada572d822f561e35138d15ae91.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:4292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:4328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:96
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 964
  2⤵
  - Program crash
  PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/96-29-0x0000000007DD0000-0x0000000007E1B000-memory.dmp

Filesize
300KB

Download
memory/96-28-0x0000000007C50000-0x0000000007C8E000-memory.dmp

Filesize
248KB

Download
memory/96-37-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/96-34-0x0000000009CD0000-0x000000000A1FC000-memory.dmp

Filesize
5.2MB

Download
memory/96-33-0x00000000095D0000-0x0000000009792000-memory.dmp

Filesize
1.8MB

Download
memory/96-32-0x0000000008110000-0x000000000812E000-memory.dmp

Filesize
120KB

Download
memory/96-31-0x00000000088E0000-0x0000000008956000-memory.dmp

Filesize
472KB

Download
memory/96-30-0x0000000007F50000-0x0000000007FB6000-memory.dmp

Filesize
408KB

Download
memory/96-20-0x00000000053A0000-0x000000000589E000-memory.dmp

Filesize
5.0MB

Download
memory/96-27-0x0000000007BF0000-0x0000000007C02000-memory.dmp

Filesize
72KB

Download
memory/96-26-0x0000000007CC0000-0x0000000007DCA000-memory.dmp

Filesize
1.0MB

Download
memory/96-17-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/96-25-0x0000000008150000-0x0000000008756000-memory.dmp

Filesize
6.0MB

Download
memory/96-21-0x0000000004F80000-0x0000000005012000-memory.dmp

Filesize
584KB

Download
memory/96-23-0x0000000005100000-0x000000000510A000-memory.dmp

Filesize
40KB

Download
memory/96-22-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/96-24-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/1448-1-0x0000000000C60000-0x00000000010BA000-memory.dmp

Filesize
4.4MB

Download
memory/1448-35-0x0000000073ACE000-0x0000000073ACF000-memory.dmp

Filesize
4KB

Download
memory/1448-16-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/1448-15-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/1448-14-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/1448-2-0x0000000005900000-0x000000000599C000-memory.dmp

Filesize
624KB

Download
memory/1448-11-0x0000000003400000-0x0000000003410000-memory.dmp

Filesize
64KB

Download
memory/1448-12-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/1448-19-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/1448-0-0x0000000073ACE000-0x0000000073ACF000-memory.dmp

Filesize
4KB

Download
memory/1448-5-0x0000000006F60000-0x00000000070F2000-memory.dmp

Filesize
1.6MB

Download
memory/1448-4-0x0000000006CC0000-0x0000000006F5A000-memory.dmp

Filesize
2.6MB

Download
memory/1448-13-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/1448-3-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing