def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
Size

2.8MB
MD5

4fe072b888cd64ff01d73d8b80bfcf3e
SHA1

d13cbf11d9ce3c8271a04c46aea473b0d469fdb1
SHA256

def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24
SHA512

566b28c08625a1a9149a34b6176dce22d5da2830c1df89f390bc8eeb062cb79694b73a486b7bab7fb6d18c80efc73eb4a3e8976fdec6695d1072cd4999fc0a2b
SSDEEP

49152:L3odaJHGVBGlKwJJWjTC6E2SEB98SldUzXhkHnsQDhuqqXWJOPp9X+qCko:7Dpzwkd6AEL3l4RUTqXWJOPp9uq2

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2148	crypted-stealer.exe

Loads dropped DLL 6 IoCs

pid	Process
2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
4768	WerFault.exe
4768	WerFault.exe
4768	WerFault.exe
4768	WerFault.exe
4768	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinInstUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WinInstUpdate.exe"	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2164	2100	WerFault.exe	29
4768	2148	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted-stealer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
2148	crypted-stealer.exe
2148	crypted-stealer.exe
2148	crypted-stealer.exe
2148	crypted-stealer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
Token: SeDebugPrivilege	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
Token: SeDebugPrivilege	2148	crypted-stealer.exe
Token: SeDebugPrivilege	2148	crypted-stealer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2148	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe	31
PID 2100 wrote to memory of 2148	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe	31
PID 2100 wrote to memory of 2148	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe	31
PID 2100 wrote to memory of 2148	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe	31
PID 2100 wrote to memory of 2164	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe	32
PID 2100 wrote to memory of 2164	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe	32
PID 2100 wrote to memory of 2164	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe	32
PID 2100 wrote to memory of 2164	2100	def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe	32
PID 2148 wrote to memory of 4768	2148	crypted-stealer.exe	33
PID 2148 wrote to memory of 4768	2148	crypted-stealer.exe	33
PID 2148 wrote to memory of 4768	2148	crypted-stealer.exe	33
PID 2148 wrote to memory of 4768	2148	crypted-stealer.exe	33

C:\Users\Admin\AppData\Local\Temp\def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe
"C:\Users\Admin\AppData\Local\Temp\def9c953d890a13ad2bbee642ff2aa1794dbddb2df0663cae873115116144d24.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\crypted-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\crypted-stealer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 804
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 1048
  2⤵
  - Program crash
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\crypted-stealer.exe

Filesize
1.6MB

MD5
216f879b8cf03c967cd45090b6e466e1

SHA1
bf17ece912d95b76d466c74a9e1fdfec83bfc8ec

SHA256
a8f845ee270ee5fcc09702387e12d0fcb7d8079517c6c70b984fe176e14d117a

SHA512
dd173ba3923db9b2984db86438393df7764a6d12a5ca5f1a9cc3e737e99f3baacba628e67e6076f653a9871b8c959f716d8258d25f631a18f43cdd021325f8df

Download Submit
memory/2100-0-0x000000007409E000-0x000000007409F000-memory.dmp

Filesize
4KB

Download
memory/2100-1-0x0000000000EF0000-0x00000000011BC000-memory.dmp

Filesize
2.8MB

Download
memory/2100-2-0x0000000004E40000-0x00000000050FA000-memory.dmp

Filesize
2.7MB

Download
memory/2100-3-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-4-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-6-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-26-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-32-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-36-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-42-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-48-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-60-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-58-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-62-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-56-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-64-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-54-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-52-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-50-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-46-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-44-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-40-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-38-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-34-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-30-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-28-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-24-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-22-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-20-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-18-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-16-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-14-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-12-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-10-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-8-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-66-0x0000000004E40000-0x00000000050F3000-memory.dmp

Filesize
2.7MB

Download
memory/2100-1078-0x0000000000A40000-0x0000000000A8C000-memory.dmp

Filesize
304KB

Download
memory/2100-1077-0x00000000057B0000-0x00000000059E4000-memory.dmp

Filesize
2.2MB

Download
memory/2100-1080-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-1079-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-1088-0x0000000004720000-0x0000000004774000-memory.dmp

Filesize
336KB

Download
memory/2100-2175-0x000000007409E000-0x000000007409F000-memory.dmp

Filesize
4KB

Download
memory/2100-2176-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-1090-0x0000000000CB0000-0x0000000000E58000-memory.dmp

Filesize
1.7MB

Download
memory/2148-1091-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-1092-0x0000000004D30000-0x0000000004EB4000-memory.dmp

Filesize
1.5MB

Download
memory/2148-2167-0x00000000055C0000-0x00000000056BE000-memory.dmp

Filesize
1016KB

Download
memory/2148-2168-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-2169-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-2177-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download