Analysis
- max time kernel
144s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
27/08/2024, 12:33
General
- Target TT ViewBot v3.7/bot_start.exe
- Size 197KB
- Sample240827-precws1bkd
- SHA256 c4174541aa2cef599aee7a376e5de3393446f0018a850fcf1c6658da9692bed5
Malware Config
Signatures
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT ViewBot v3.7\bot_start.exe"C:\Users\Admin\AppData\Local\Temp\TT ViewBot v3.7\bot_start.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sWsmPty.exe"C:\Users\Admin\AppData\Roaming\sWsmPty.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
VC_redistx64.exe
sWsmPty.exe
memory/1812-69-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-30-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-31-0x0000000003730000-0x0000000003938000-memory.dmp
memory/1812-68-0x0000000000400000-0x000000000114E000-memory.dmp
memory/1812-76-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-18-0x00000000011A0000-0x00000000011A1000-memory.dmp
memory/1812-81-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-19-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-39-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-73-0x00000000011A0000-0x00000000011A1000-memory.dmp
memory/1812-36-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-38-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-37-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-35-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-34-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-33-0x0000000140000000-0x0000000140273000-memory.dmp
memory/1812-32-0x0000000140000000-0x0000000140273000-memory.dmp
memory/4016-22-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/4016-2-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/4016-17-0x0000000074ABE000-0x0000000074ABF000-memory.dmp
memory/4016-1-0x0000000000F30000-0x0000000000F62000-memory.dmp
memory/4016-52-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/4016-5-0x0000000008F90000-0x0000000009534000-memory.dmp
memory/4016-4-0x00000000058C0000-0x00000000058CA000-memory.dmp
memory/4016-0-0x0000000074ABE000-0x0000000074ABF000-memory.dmp
memory/4016-3-0x0000000003280000-0x000000000328C000-memory.dmp
memory/4356-77-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-74-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-71-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-79-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-48-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-89-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-90-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-91-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-92-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-93-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-94-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-95-0x0000000000B90000-0x00000000015ED000-memory.dmp
memory/4356-96-0x0000000000B90000-0x00000000015ED000-memory.dmp