Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-11-2024 11:20

General

  • Target

    main.exe

  • Size

    5.6MB

  • MD5

    3d3c49dd5d13a242b436e0a065cd6837

  • SHA1

    e38a773ffa08452c449ca5a880d89cfad24b6f1b

  • SHA256

    e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

  • SHA512

    dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00

  • SSDEEP

    98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR6s:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciY

Malware Config

Signatures

  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

  • Milleniumrat family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpE263.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpE263.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Windows\system32\tasklist.exe
        Tasklist /fi "PID eq 2276"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2720
      • C:\Windows\system32\find.exe
        find ":"
        3⤵
          PID:2772
        • C:\Windows\system32\timeout.exe
          Timeout /T 1 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:2804
        • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
          "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2768
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2588
            • C:\Windows\system32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
              5⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:2692
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 2768 -s 1828
            4⤵
              PID:1240

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmpE263.tmp.bat

        Filesize

        256B

        MD5

        1bfc1ea8355e31e2704e2ccb0d20285c

        SHA1

        93bd6f6ebfeb10033859ec866a3129a397a154c5

        SHA256

        712280053827c34b8ec0b08f7fe26b3afc08ef92785ff28496013d42bf874d81

        SHA512

        78a6e4c78bc6318e1dd3b984fc3df01fc549f7d8e196e6bf89162b5d87dab3037ea2142f638cad3d3a8e20620d812f22b8cafdf594b1d4b0ca6ac9e37bfe7513

      • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe

        Filesize

        5.6MB

        MD5

        3d3c49dd5d13a242b436e0a065cd6837

        SHA1

        e38a773ffa08452c449ca5a880d89cfad24b6f1b

        SHA256

        e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

        SHA512

        dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00

      • \Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

        Filesize

        1.7MB

        MD5

        65ccd6ecb99899083d43f7c24eb8f869

        SHA1

        27037a9470cc5ed177c0b6688495f3a51996a023

        SHA256

        aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

        SHA512

        533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

      • memory/2276-0-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

        Filesize

        4KB

      • memory/2276-1-0x00000000000A0000-0x0000000000640000-memory.dmp

        Filesize

        5.6MB

      • memory/2276-6-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

        Filesize

        9.9MB

      • memory/2276-9-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

        Filesize

        9.9MB

      • memory/2768-14-0x0000000000810000-0x0000000000DB0000-memory.dmp

        Filesize

        5.6MB

      • memory/2768-17-0x000000001AD90000-0x000000001ADFA000-memory.dmp

        Filesize

        424KB

      • memory/2768-20-0x000000001AEA0000-0x000000001AEC5000-memory.dmp

        Filesize

        148KB