Analysis

  • max time kernel
    195s
  • max time network
    257s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/05/2024, 23:20

General

  • Target

    a6516b7a67fd64731c893ad8ee12c2878673841cbb756a8e597812da52b08027.exe

  • Size

    539KB

  • MD5

    9d4d3e9107fab87e6b86d8ad6cfc8244

  • SHA1

    841e2183ebee75b32319ce7cf81f82f8d2ca3cea

  • SHA256

    a6516b7a67fd64731c893ad8ee12c2878673841cbb756a8e597812da52b08027

  • SHA512

    e9da618fa873db7a2b5ab4813db6ef6bd0c2356c4682c9415b9b62dc192e1fc8e5fee423c698cc3695e665e2699664c68c8041746ad0e51753309a9bc21eecf3

  • SSDEEP

    12288:v5d20CeBNGZiM1KVO0VeUOmC5sf52gpc/6ZpKS9fJsM9gQ07DG2iHh9v7zZwZE+t:xd20rwZiM1d0V78m4WL

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6516b7a67fd64731c893ad8ee12c2878673841cbb756a8e597812da52b08027.exe
    "C:\Users\Admin\AppData\Local\Temp\a6516b7a67fd64731c893ad8ee12c2878673841cbb756a8e597812da52b08027.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1472

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Roaming\d3d9.dll

          Filesize

          923KB

          MD5

          e496eb04f812481319e7ebc5f64c253b

          SHA1

          029b852d41223c4c246f51026acbf7b6b7856d28

          SHA256

          1233aaf0fd000edcfaf0e4f96f1878fea2d8defab0d6c26cfae7167c21c4ba93

          SHA512

          edb5becec9a2292e9c982eb7b1dfc0f0e473a1800425245738d689bec2b3ac3c4f21e8074a4308c38a21dbd77216242708302ed98feb128e8cbde818a6c0dd85

        • memory/1472-24-0x0000000007F40000-0x0000000007F8B000-memory.dmp

          Filesize

          300KB

        • memory/1472-19-0x0000000004D90000-0x0000000004D9A000-memory.dmp

          Filesize

          40KB

        • memory/1472-31-0x0000000073DE0000-0x00000000744CE000-memory.dmp

          Filesize

          6.9MB

        • memory/1472-28-0x0000000009670000-0x0000000009832000-memory.dmp

          Filesize

          1.8MB

        • memory/1472-10-0x0000000000400000-0x00000000004CC000-memory.dmp

          Filesize

          816KB

        • memory/1472-29-0x0000000009D70000-0x000000000A29C000-memory.dmp

          Filesize

          5.2MB

        • memory/1472-18-0x0000000073DE0000-0x00000000744CE000-memory.dmp

          Filesize

          6.9MB

        • memory/1472-27-0x0000000008280000-0x000000000829E000-memory.dmp

          Filesize

          120KB

        • memory/1472-15-0x00000000051C0000-0x00000000056BE000-memory.dmp

          Filesize

          5.0MB

        • memory/1472-16-0x0000000073DE0000-0x00000000744CE000-memory.dmp

          Filesize

          6.9MB

        • memory/1472-26-0x0000000008A60000-0x0000000008AD6000-memory.dmp

          Filesize

          472KB

        • memory/1472-25-0x00000000080D0000-0x0000000008136000-memory.dmp

          Filesize

          408KB

        • memory/1472-23-0x0000000007DD0000-0x0000000007E0E000-memory.dmp

          Filesize

          248KB

        • memory/1472-20-0x00000000082D0000-0x00000000088D6000-memory.dmp

          Filesize

          6.0MB

        • memory/1472-22-0x0000000007D70000-0x0000000007D82000-memory.dmp

          Filesize

          72KB

        • memory/1472-21-0x0000000007E30000-0x0000000007F3A000-memory.dmp

          Filesize

          1.0MB

        • memory/1472-17-0x0000000004DA0000-0x0000000004E32000-memory.dmp

          Filesize

          584KB

        • memory/4196-0-0x0000000073DEE000-0x0000000073DEF000-memory.dmp

          Filesize

          4KB

        • memory/4196-13-0x0000000073DE0000-0x00000000744CE000-memory.dmp

          Filesize

          6.9MB

        • memory/4196-2-0x0000000005560000-0x0000000005566000-memory.dmp

          Filesize

          24KB

        • memory/4196-14-0x0000000073DE0000-0x00000000744CE000-memory.dmp

          Filesize

          6.9MB

        • memory/4196-12-0x00000000748F0000-0x0000000074950000-memory.dmp

          Filesize

          384KB

        • memory/4196-1-0x0000000000B10000-0x0000000000B9E000-memory.dmp

          Filesize

          568KB

        • memory/4196-9-0x0000000073DE0000-0x00000000744CE000-memory.dmp

          Filesize

          6.9MB