Overview

overview

10

Static

static

1

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 18:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e731f79ee3512fefe48e53b4424145efc6a1b2585220b9c6025038d5f1263055.exe

  • Size

    3.2MB

  • MD5

    03fe60596aa8f9b633ac360fd9ec42d8

  • SHA1

    1e7bc8d80c7a2a315639b09d332a549dc7ddcb4b

  • SHA256

    e731f79ee3512fefe48e53b4424145efc6a1b2585220b9c6025038d5f1263055

  • SHA512

    d6f080881874112c2876ed691a6c725ce0cc87196934fd8fa9ff488619c84e6e4a9c244c0840999b6a6cce95b4b7375648cf3011d79927e90a0c786895c0cfdf

  • SSDEEP

    12288:eVUIvxgHpihp0207/YGL9jDUsDDBGqrm77t:eaexgHAhp020DL9HUSdGqU7t

Score
10/10
credential_accessdiscoveryevasionexecutionspywarestealertrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e731f79ee3512fefe48e53b4424145efc6a1b2585220b9c6025038d5f1263055.exe
    "C:\Users\Admin\AppData\Local\Temp\e731f79ee3512fefe48e53b4424145efc6a1b2585220b9c6025038d5f1263055.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Checks computer location settings
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4248
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e731f79ee3512fefe48e53b4424145efc6a1b2585220b9c6025038d5f1263055.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4340
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      2⤵
        PID:4436
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        2⤵
        • Drops startup file
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2980
        • C:\Users\Admin\Pictures\os9svhC7C6sN3ZeGnDcwGiJX.exe
          "C:\Users\Admin\Pictures\os9svhC7C6sN3ZeGnDcwGiJX.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:1540
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        2⤵
          PID:3148

      Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            3
            T1562

            Disable or Modify Tools

            3
            T1562.001

            Modify Registry

            4
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vybaqz0f.zhk.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\Pictures\bqFR3xlxZEY32O6Ee1hnrNa7.exe
              Filesize

              7KB

              MD5

              77f762f953163d7639dff697104e1470

              SHA1

              ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

              SHA256

              d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

              SHA512

              d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

              Download Submit

            • C:\Users\Admin\Pictures\os9svhC7C6sN3ZeGnDcwGiJX.exe
              Filesize

              2.9MB

              MD5

              ed44f8677bf65b35ddd09cb63652dcc3

              SHA1

              218bab3e80375398ea00b94f1d78faacdbe35b4a

              SHA256

              31ded96a7e06729efbd409f297616062fe2aedd32791a78fe48a56224aaebb8a

              SHA512

              702f698a09ca42a3595cf4f2ecdf720b7372dd020857b3a3d3c7ee16deb4699442a9f31f41878c911d6021bf4f23b8583dc2c9c803aca34c7969649fbe1d63f6

              Download Submit

            • memory/1540-45-0x0000000000400000-0x0000000000C98000-memory.dmp

              Filesize

              8.6MB

              Download

            • memory/1540-44-0x0000000000400000-0x0000000000C98000-memory.dmp

              Filesize

              8.6MB

              Download

            • memory/2980-18-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

              Download

            • memory/4248-22-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4248-0-0x00000160529C0000-0x00000160529CA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/4248-4-0x0000016052D70000-0x0000016052DCA000-memory.dmp

              Filesize

              360KB

              Download

            • memory/4248-3-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4248-2-0x0000016052D60000-0x0000016052D66000-memory.dmp

              Filesize

              24KB

              Download

            • memory/4248-1-0x00007FF83D603000-0x00007FF83D605000-memory.dmp

              Filesize

              8KB

              Download

            • memory/4340-11-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4340-16-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4340-17-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4340-5-0x000001CBC82C0000-0x000001CBC82E2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/4340-21-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

              Filesize

              10.8MB

              Download