Analysis

  • max time kernel
    124s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2024 11:29

General

  • Target

    510286.msi

  • Size

    1.8MB

  • MD5

    66b16b0e40121de05fc889765a9a2f54

  • SHA1

    72bbd8cda91693a0f655c67b0e2e9f86efaecc73

  • SHA256

    e158310cb13d1a48304d68dfd83447c4208f27e03f4f13d6a2184364a7c174e4

  • SHA512

    0bddd047a67d76bba80514138ee591f4b3b47ffc7240b2bbf5f2260c34e0c333f7c4a8a967ae76631187ef4988e4aa9a0af9c585c0202c1534c2144779456c33

  • SSDEEP

    24576:wt9cpVDhnsV2kDzeOahNZVtRIGE6czXkTXqH:vpRhnlazeOahNZVtaGPcx

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Metastealer family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\510286.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2488
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5104
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9FA0D6DB35D14D6D697DEEBBCF3CE1A5
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-23688d49-111f-4033-b07f-4733378f2400\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:3192
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:212
      • C:\Users\Admin\AppData\Local\Temp\MW-23688d49-111f-4033-b07f-4733378f2400\files\piovbar.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-23688d49-111f-4033-b07f-4733378f2400\files\piovbar.exe" /VERYSILENT /VERYSILENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3508
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:3332
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MW-23688d49-111f-4033-b07f-4733378f2400\files.cab

    Filesize

    1.5MB

    MD5

    a5bb958f9fc3480a53e0e11069a295ae

    SHA1

    b7711d41344c19c8f08a5be0ac2aa0581d685b18

    SHA256

    63be86007d54161303371b93113af3847f5611ef8b689450dc87d95acd130f70

    SHA512

    d611691f786c53ac80c0d1377630702b587ad00306e6ffb4468db254bee24389c584d8aab26ace4e635a44a2bf46b64d48c118c31a424343df5f10c5dbe9d94c

  • C:\Users\Admin\AppData\Local\Temp\MW-23688d49-111f-4033-b07f-4733378f2400\msiwrapper.ini

    Filesize

    1KB

    MD5

    5b19847cfad6e68a57dfc868f5cf6fe3

    SHA1

    529dcae4053cd9a3f6d3c1aa6aaa696b1367e1c4

    SHA256

    1566f067ef8e2a62ff969b97db5fbfe8c572571e4fa82557753405117852a5dc

    SHA512

    c0770d90c67a46ea2c8b83f4e78a9de536e0e652ae2e3608531006a4d287e2ca281018b7b63aeab2971c7d9e2a95fc107be7a311b35cfb03c5eb9dc0f31a50bc

  • C:\Users\Admin\AppData\Local\Temp\MW-23688d49-111f-4033-b07f-4733378f2400\msiwrapper.ini

    Filesize

    1KB

    MD5

    a55c508c8e1063f6a36cc3d3347d81ee

    SHA1

    5b048198a34596a3e42ceb3c021a86ab4ea24201

    SHA256

    482d6990671d5b33c8860a02d9ac73c9c37917db1d23443376fc0f20b577329a

    SHA512

    29e7c22e87cb53fa65dbda425cbfe95d0db88dd5fe7c88d6dcb678cbd79da348480b95643f1911e143e1e816c3a0c42dcdb809dffa5e5dfc390108b828442e8c

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1dgdxpos.035.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Windows\Installer\MSIB8C1.tmp

    Filesize

    208KB

    MD5

    0c8921bbcc37c6efd34faf44cf3b0cb5

    SHA1

    dcfa71246157edcd09eecaf9d4c5e360b24b3e49

    SHA256

    fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

    SHA512

    ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

    Filesize

    24.1MB

    MD5

    ca5c1d2c0b9817277e2209033bc34466

    SHA1

    cd227d343296f38ed425dba37a1d5aa2a8225266

    SHA256

    55dcce3942bfa3790dafde6c941ed700f615e5e232b920e452562b60d89ccc58

    SHA512

    ad0399c91ccd61b30ac77e12ac1c240b59e3b2db0ad953e3264b6e0c2f2c507f020054f83c105638941dbf82d1a6083319470badfd0375bfdf400f2057fd9493

  • \??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{406b502e-728e-4674-9047-acf79331464a}_OnDiskSnapshotProp

    Filesize

    6KB

    MD5

    64b5186af2d9d8034ef1eb360d600962

    SHA1

    812e37f3605c40b755f4f24111948bc649e15aed

    SHA256

    909ff5b2163ca3f957d0813627f3d70767de1f3163f9430f54ec7954c196c92e

    SHA512

    5b23274eaddc6b81d529f763769623fff2f04a8383e3b899b6da2ede9941d26ce29a6e6b472bd385c602ec08168bf8c7bfa4d3fd371c34560a9814d3691369ba

  • memory/992-75-0x0000000010000000-0x0000000010731000-memory.dmp

    Filesize

    7.2MB

  • memory/3508-96-0x0000000006920000-0x000000000693E000-memory.dmp

    Filesize

    120KB

  • memory/3508-110-0x0000000007B20000-0x0000000007BC3000-memory.dmp

    Filesize

    652KB

  • memory/3508-85-0x0000000006340000-0x00000000063A6000-memory.dmp

    Filesize

    408KB

  • memory/3508-81-0x0000000005A40000-0x0000000006068000-memory.dmp

    Filesize

    6.2MB

  • memory/3508-84-0x0000000006260000-0x00000000062C6000-memory.dmp

    Filesize

    408KB

  • memory/3508-95-0x00000000064B0000-0x0000000006804000-memory.dmp

    Filesize

    3.3MB

  • memory/3508-80-0x0000000005370000-0x00000000053A6000-memory.dmp

    Filesize

    216KB

  • memory/3508-97-0x0000000006970000-0x00000000069BC000-memory.dmp

    Filesize

    304KB

  • memory/3508-99-0x000000006EA70000-0x000000006EABC000-memory.dmp

    Filesize

    304KB

  • memory/3508-109-0x0000000007B00000-0x0000000007B1E000-memory.dmp

    Filesize

    120KB

  • memory/3508-98-0x0000000006EF0000-0x0000000006F22000-memory.dmp

    Filesize

    200KB

  • memory/3508-83-0x0000000005970000-0x0000000005992000-memory.dmp

    Filesize

    136KB

  • memory/3508-111-0x0000000008290000-0x000000000890A000-memory.dmp

    Filesize

    6.5MB

  • memory/3508-112-0x0000000007C50000-0x0000000007C6A000-memory.dmp

    Filesize

    104KB

  • memory/3508-113-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

    Filesize

    40KB

  • memory/3508-114-0x0000000007EE0000-0x0000000007F76000-memory.dmp

    Filesize

    600KB

  • memory/3508-115-0x0000000007E50000-0x0000000007E61000-memory.dmp

    Filesize

    68KB

  • memory/3508-116-0x0000000007E90000-0x0000000007E9E000-memory.dmp

    Filesize

    56KB

  • memory/3508-117-0x0000000007EA0000-0x0000000007EB4000-memory.dmp

    Filesize

    80KB

  • memory/3508-118-0x0000000007F80000-0x0000000007F9A000-memory.dmp

    Filesize

    104KB

  • memory/3508-119-0x0000000007ED0000-0x0000000007ED8000-memory.dmp

    Filesize

    32KB