789fa6d8c4018b6c0ce501afea23afac96ab3a3b7dbca28e3a91bc3445415b03

Analysis

max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Server.exe
Size 93KB
Sample240615-basmasxbqm
SHA256 789fa6d8c4018b6c0ce501afea23afac96ab3a3b7dbca28e3a91bc3445415b03
MD5 5e59c10d27fe45c6f2541f435849964e
SHA1 af8e15e4235856f70e1336a93e2e38cf651fa70c
SHA512 7a8b0d41c63c5ba56c5a1d7a80139c9c48e685c86ad4617f631c7d3304f3d6b64eaeec3f323ad6135f410fb7cec5ad281f6f3afce41bd5d502ca89872996d660
SSDEEP 1536:NUnkm9BduGQ0n83TOKAJjEwzGi1dDzDpgS:NUnXuGQ0nYAGi1d7m
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion spyware stealer

Malware Config

Signatures

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3056-36-0x0000000000540000-0x00000000005B6000-memory.dmp	WebBrowserPassView
behavioral2/files/0x0007000000023579-52.dat	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/3056-36-0x0000000000540000-0x00000000005B6000-memory.dmp	Nirsoft
behavioral2/files/0x0007000000023577-47.dat	Nirsoft
behavioral2/files/0x0007000000023579-52.dat	Nirsoft

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2040	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	server.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\435f487788a48ba41a529a30e89285c9Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\435f487788a48ba41a529a30e89285c9Windows Update.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe

Executes dropped EXE 5 IoCs

pid	Process
1904	server.exe
3056	tmpE8A6.tmp.exe
1652	ProduKey.exe
3012	WebBrowserPassView.exe
4656	tmpCDF6.tmp.bat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe
3012	WebBrowserPassView.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1904	server.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe
Token: 33	1904	server.exe
Token: SeIncBasePriorityPrivilege	1904	server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1904	server.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1904	2380	Server.exe	89
PID 2380 wrote to memory of 1904	2380	Server.exe	89
PID 2380 wrote to memory of 1904	2380	Server.exe	89
PID 1904 wrote to memory of 2040	1904	server.exe	91
PID 1904 wrote to memory of 2040	1904	server.exe	91
PID 1904 wrote to memory of 2040	1904	server.exe	91
PID 1904 wrote to memory of 1936	1904	server.exe	99
PID 1904 wrote to memory of 1936	1904	server.exe	99
PID 1904 wrote to memory of 1936	1904	server.exe	99
PID 1904 wrote to memory of 3056	1904	server.exe	101
PID 1904 wrote to memory of 3056	1904	server.exe	101
PID 1904 wrote to memory of 3056	1904	server.exe	101
PID 3056 wrote to memory of 1652	3056	tmpE8A6.tmp.exe	102
PID 3056 wrote to memory of 1652	3056	tmpE8A6.tmp.exe	102
PID 3056 wrote to memory of 1652	3056	tmpE8A6.tmp.exe	102
PID 3056 wrote to memory of 3012	3056	tmpE8A6.tmp.exe	103
PID 3056 wrote to memory of 3012	3056	tmpE8A6.tmp.exe	103
PID 3056 wrote to memory of 3012	3056	tmpE8A6.tmp.exe	103
PID 1904 wrote to memory of 4656	1904	server.exe	105
PID 1904 wrote to memory of 4656	1904	server.exe	105
PID 1904 wrote to memory of 4656	1904	server.exe	105

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2380
- C:\ProgramData\server.exe
  "C:\ProgramData\server.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\ProgramData\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\tmpE8A6.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpE8A6.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\ProduKey.exe
      C:\Users\Admin\AppData\Local\Temp\\ProduKey.exe /stext C:\Users\Admin\AppData\Local\Temp\pass5.txt
      4⤵
      Executes dropped EXE
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\WebBrowserPassView.exe
      C:\Users\Admin\AppData\Local\Temp\\WebBrowserPassView.exe /stext C:\Users\Admin\AppData\Local\Temp\pass6.txt
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3012
- - C:\Users\Admin\AppData\Local\Temp\tmpCDF6.tmp.bat
    "C:\Users\Admin\AppData\Local\Temp\tmpCDF6.tmp.bat"
    3⤵
    - Executes dropped EXE
    PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe

Path C:\ProgramData\server.exe
Size 93KB
SHA256 789fa6d8c4018b6c0ce501afea23afac96ab3a3b7dbca28e3a91bc3445415b03
MD5 5e59c10d27fe45c6f2541f435849964e
SHA1 af8e15e4235856f70e1336a93e2e38cf651fa70c
SHA512 7a8b0d41c63c5ba56c5a1d7a80139c9c48e685c86ad4617f631c7d3304f3d6b64eaeec3f323ad6135f410fb7cec5ad281f6f3afce41bd5d502ca89872996d660
SSDEEP 1536:NUnkm9BduGQ0n83TOKAJjEwzGi1dDzDpgS:NUnXuGQ0nYAGi1d7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

server.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log
Size 408B
SHA256 8f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
MD5 661cab77d3b907e8057f2e689e995af3
SHA1 5d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c
SHA512 2523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67
MD5 SHA1 SHA512

Submit Download

ProduKey.exe

Path C:\Users\Admin\AppData\Local\Temp\ProduKey.exe
Size 79KB
SHA256 33da091e5a972e184d0ad313398d7ee52afbcee5f5ba8af8f871ec9850a5a5ea
MD5 24ce2a2f94f0fe572973f5389bedaaeb
SHA1 0cb2e3a4e662a57264d588440b303054e5c17516
SHA512 e724cf8b66a0a890b63598a156ad743556a616702854687b3b8655622fd9df0878eca66f72397fb7f6a4d60d466f961e319fb68a76ab0c47f725ed94a8e22810
SSDEEP 1536:g59/+iBjsB7ySvVkVoJE436SXKQmcfPo2GGeeTLW7R:gnSQbVoJBXKQTGGeeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebBrowserPassView.exe

Path C:\Users\Admin\AppData\Local\Temp\WebBrowserPassView.exe
Size 343KB
SHA256 7d005098e2d422ac97a3d0497f0c4238d9fdcbb4cf3fdc3264cd784e66485806
MD5 e8151c3940b5fa3e788d4ba14e7a8dc0
SHA1 6e7ab63b1dfaaac4b4ec27684fa0e1ca5c2b1963
SHA512 5823460ca60d62e472ff11fd307c182c5d30114953e09cd182a7aab2b2331f88e9984ec3c95a42d4697d10be2b3dff953517066a018de635cf81630f3bf2d5a3
SSDEEP 6144:hdbbkIVYwKclE2rl4yQt15xk62c+IyaLLqcVpVAt1MkihR:r3uLArUQy+Iyofnke
MD5 SHA1 SHA512 SSDEEP

Submit Download

pass5.txt

Path C:\Users\Admin\AppData\Local\Temp\pass5.txt
Size 726B
SHA256 a444fa18d376944db908c12e237ce440b399cb884b5d4e9e941ba33f2bbb2db7
MD5 109955003b80174ad62928472fc2b58c
SHA1 6ac5d7744653b730d91c9b257eee546fb40e0cd4
SHA512 6b8c1c1e46b989cd17520f98aac2052b73a2292031595da6fcec407664d7b93cfd49fa3e784c12c5d2721e7f710bd40582254860c8e753de115883c9c8fff958
MD5 SHA1 SHA512

Submit Download

pass6.txt

Path C:\Users\Admin\AppData\Local\Temp\pass6.txt
Size 3KB
SHA256 efa03262d4c3f5a46ab526946b8c7450d37eff4b5f8d53b43468655eea8cc027
MD5 b9daf88205e7429feaceda806bd561d2
SHA1 1893c80e74cfea9914343c6e4213393804a92dd1
SHA512 649ba70698611bd66aa91e40aaa81327a60efc098c1705729f9eb316c18e9bcca6af2363b24f8ac4aea5d25f12303833aedaada6fd26f1eebb86711a4e9baaf1
MD5 SHA1 SHA512

Submit Download

tmpCDF6.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpCDF6.tmp.bat
Size 100KB
SHA256 19dc8c66d04d1a1d781e59107e2a1db5fd6288761c9dfd0c6909e533e79d04e7
MD5 6032ce8ceea46af873b78c1f323547da
SHA1 8c5bd4a70e0f21aeba41c07976ace2919b64fd80
SHA512 3ada1663cb730f43b44e32ceade5d0b9cae20d1c20001691a1d226d99c82510e001581f67f5131d6c21e0e0cf98e5089c3d0f22a6a1e3347053ed73304ccc6fe
SSDEEP 1536:CQvlJNxwHPmtN2dWWWQmMTuAip6XIbY6i32Kf3oKwfTjK2f20:CQNwaFET6p6XOY6i32U3BwfPK2e0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpE8A6.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpE8A6.tmp.exe
Size 403KB
SHA256 6d0b37a62e1d2215e2fd8936d3d1d13cd1d620d7678c773e013e70ccf55a674d
MD5 b8cb1a1d76fe3fd71ac5b5fc175b699d
SHA1 611589181cb1bb72a279e44116fa3ed7c1256ded
SHA512 280d2dbb4702498e11879c1fbf62c6eac8a2c97c2cc520f310e658ee5162329e24ba23d752ba8f549c0ffc85d5c83781ea1c10788ad6546258f83ed9c3c2cc25
SSDEEP 12288:u7eVQkTrvj4bwVmWyQSo6aQNlcjDzJsu2N:ueQkTf4sVmWyQSo65ToRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

app

Path C:\Users\Admin\AppData\Roaming\app
Size 5B
SHA256 57a8ff317e913b7e08c0a1758997ed0ffc2f1aba0a3b3310c7697bc207fd15e5
MD5 aa3cce4f6c83d5adfcfc45934b274cc6
SHA1 20e102f0ad9f95951786af279e5215d2ecf85126
SHA512 f9ec7cd14188f6f7cc00d64dfd7781fc425b7dd24d8fa70d9382cd127bbcc657c734812bc50ba0761393b1a89de9dc02f0d90e8377d6387f24e2d36c98d185cf
MD5 SHA1 SHA512

Submit Download

memory/1904-14-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/1904-16-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/1904-24-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/1904-22-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/1904-75-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/1904-23-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/1904-62-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/2380-0-0x0000000074932000-0x0000000074933000-memory.dmp

Download

memory/2380-2-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/2380-15-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/2380-1-0x0000000074930000-0x0000000074EE1000-memory.dmp

Download

memory/3056-36-0x0000000000540000-0x00000000005B6000-memory.dmp

Download

memory/4656-68-0x0000000000DD0000-0x0000000000DF0000-memory.dmp

Download

memory/4656-69-0x00000000056D0000-0x000000000576C000-memory.dmp

Download

memory/4656-70-0x0000000005D20000-0x00000000062C4000-memory.dmp

Download

memory/4656-71-0x0000000005770000-0x0000000005802000-memory.dmp

Download

memory/4656-72-0x00000000056A0000-0x00000000056AA000-memory.dmp

Download

memory/4656-73-0x0000000005990000-0x00000000059E6000-memory.dmp

Download