7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5

General

Target

7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe
Size

685KB
MD5

434db6498e3f0dbf38a81e70b63917c8
SHA1

da4aa123120a9fc37c014d79ffabc0dacb3797bd
SHA256

7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5
SHA512

947fd9fd66155e62e172f07a3a4fe802559df2f4a2d4359be12794a4487541dba2defc1df5a8c8a64c209e7cc3cb0ce73d1c5e9eb10c8d44f9d09fac1ac2babd
SSDEEP

12288:ZCXjum11ikTUkhHMSaYuIl8VTQK2VhEYzq2d/dIQJ6+hKR/MfmtwRxJrowGE9IOQ:QuK1ikzHMs4QnVhEYgEe

Score

9^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Loads dropped DLL 1 IoCs

pid	Process
2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2476 set thread context of 452	2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	452	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
452	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	MSBuild.exe
Token: SeBackupPrivilege	452	MSBuild.exe
Token: SeSecurityPrivilege	452	MSBuild.exe
Token: SeSecurityPrivilege	452	MSBuild.exe
Token: SeSecurityPrivilege	452	MSBuild.exe
Token: SeSecurityPrivilege	452	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 452	2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe	87
PID 2476 wrote to memory of 452	2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe	87
PID 2476 wrote to memory of 452	2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe	87
PID 2476 wrote to memory of 452	2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe	87
PID 2476 wrote to memory of 452	2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe	87
PID 2476 wrote to memory of 452	2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe	87
PID 2476 wrote to memory of 452	2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe	87
PID 2476 wrote to memory of 452	2476	7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe	87

C:\Users\Admin\AppData\Local\Temp\7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe
"C:\Users\Admin\AppData\Local\Temp\7f951fd69cc861d2a990eda2dd03e2e012737226c8a7dc0f1aba64675f2c77d5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 2668
    3⤵
    - Program crash
    PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 452 -ip 452
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\d3d9x.dll

Filesize
736KB

MD5
3a0ee43a72a29db998d74d699a044d81

SHA1
9d7f6d34eff66df7db85c04c938beb6afe7c78d3

SHA256
812453ba8d138f2d8bb2ce93207e9b6ff766ace31bb37e1001965eb250dee58d

SHA512
c7f577f6b594154c5a846fed6583a4874e10c91c1f523babf565f4704dacd064f8b861cf22b31b703ef085466581b99cc2e0743ca6bc61b745aa208ef9d745be

Download Submit
memory/452-16-0x0000000008890000-0x0000000008EA8000-memory.dmp

Filesize
6.1MB

Download
memory/452-18-0x0000000008300000-0x0000000008312000-memory.dmp

Filesize
72KB

Download
memory/452-8-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/452-26-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download
memory/452-11-0x0000000005B60000-0x0000000006104000-memory.dmp

Filesize
5.6MB

Download
memory/452-12-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download
memory/452-13-0x00000000054E0000-0x0000000005572000-memory.dmp

Filesize
584KB

Download
memory/452-14-0x00000000055C0000-0x00000000055CA000-memory.dmp

Filesize
40KB

Download
memory/452-15-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download
memory/452-25-0x000000000A690000-0x000000000ABBC000-memory.dmp

Filesize
5.2MB

Download
memory/452-24-0x0000000009F90000-0x000000000A152000-memory.dmp

Filesize
1.8MB

Download
memory/452-19-0x0000000008360000-0x000000000839C000-memory.dmp

Filesize
240KB

Download
memory/452-17-0x00000000083C0000-0x00000000084CA000-memory.dmp

Filesize
1.0MB

Download
memory/452-20-0x00000000084D0000-0x000000000851C000-memory.dmp

Filesize
304KB

Download
memory/452-21-0x0000000009120000-0x0000000009186000-memory.dmp

Filesize
408KB

Download
memory/452-22-0x00000000093D0000-0x0000000009446000-memory.dmp

Filesize
472KB

Download
memory/452-23-0x00000000090F0000-0x000000000910E000-memory.dmp

Filesize
120KB

Download
memory/2476-1-0x0000000000CA0000-0x0000000000D52000-memory.dmp

Filesize
712KB

Download
memory/2476-0-0x000000007461E000-0x000000007461F000-memory.dmp

Filesize
4KB

Download
memory/2476-10-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download
memory/2476-27-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing