fae4492b9eaf5ffc3a9ae20112e29ecd35858c75d9169be1e40e0f4056633e98

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20/01/2025, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wallpaper64.exe
Size 5.7MB
Sample250120-qw72fa1phv
SHA256 fae4492b9eaf5ffc3a9ae20112e29ecd35858c75d9169be1e40e0f4056633e98
MD5 eee5f7b19162db55aea8bd4848c53ec9
SHA1 c7f9f76c2e560df24d726706426dd8d4c281ab55
SHA512 082ea0e3c05ad310e2c3e3e2f8f4bdfe4f6bb689b290970346c8021aec097ac748890184e4cea051b9a1a6081f965f933f8b6d33e6238be5ae982996b2f524e3
SSDEEP 98304:MaqaU1XRGqF5baL3zRTkWoaUtAzfHKrOp0bJ62FbNMkihr4i:WkqFi3zRg1aUtAzirOmbY8bi9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
404	da.exe
3716	wallpaper64.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wallpaper64.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4348	wmic.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
536	calc.exe
536	calc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3716	wallpaper64.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	calc.exe
Token: SeIncreaseQuotaPrivilege	4348	wmic.exe
Token: SeSecurityPrivilege	4348	wmic.exe
Token: SeTakeOwnershipPrivilege	4348	wmic.exe
Token: SeLoadDriverPrivilege	4348	wmic.exe
Token: SeSystemProfilePrivilege	4348	wmic.exe
Token: SeSystemtimePrivilege	4348	wmic.exe
Token: SeProfSingleProcessPrivilege	4348	wmic.exe
Token: SeIncBasePriorityPrivilege	4348	wmic.exe
Token: SeCreatePagefilePrivilege	4348	wmic.exe
Token: SeBackupPrivilege	4348	wmic.exe
Token: SeRestorePrivilege	4348	wmic.exe
Token: SeShutdownPrivilege	4348	wmic.exe
Token: SeDebugPrivilege	4348	wmic.exe
Token: SeSystemEnvironmentPrivilege	4348	wmic.exe
Token: SeRemoteShutdownPrivilege	4348	wmic.exe
Token: SeUndockPrivilege	4348	wmic.exe
Token: SeManageVolumePrivilege	4348	wmic.exe
Token: 33	4348	wmic.exe
Token: 34	4348	wmic.exe
Token: 35	4348	wmic.exe
Token: 36	4348	wmic.exe
Token: SeIncreaseQuotaPrivilege	4348	wmic.exe
Token: SeSecurityPrivilege	4348	wmic.exe
Token: SeTakeOwnershipPrivilege	4348	wmic.exe
Token: SeLoadDriverPrivilege	4348	wmic.exe
Token: SeSystemProfilePrivilege	4348	wmic.exe
Token: SeSystemtimePrivilege	4348	wmic.exe
Token: SeProfSingleProcessPrivilege	4348	wmic.exe
Token: SeIncBasePriorityPrivilege	4348	wmic.exe
Token: SeCreatePagefilePrivilege	4348	wmic.exe
Token: SeBackupPrivilege	4348	wmic.exe
Token: SeRestorePrivilege	4348	wmic.exe
Token: SeShutdownPrivilege	4348	wmic.exe
Token: SeDebugPrivilege	4348	wmic.exe
Token: SeSystemEnvironmentPrivilege	4348	wmic.exe
Token: SeRemoteShutdownPrivilege	4348	wmic.exe
Token: SeUndockPrivilege	4348	wmic.exe
Token: SeManageVolumePrivilege	4348	wmic.exe
Token: 33	4348	wmic.exe
Token: 34	4348	wmic.exe
Token: 35	4348	wmic.exe
Token: 36	4348	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3716	wallpaper64.exe
3716	wallpaper64.exe
3716	wallpaper64.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3716	wallpaper64.exe
3716	wallpaper64.exe
3716	wallpaper64.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 404	892	wallpaper64.exe	77
PID 892 wrote to memory of 404	892	wallpaper64.exe	77
PID 404 wrote to memory of 536	404	da.exe	81
PID 404 wrote to memory of 536	404	da.exe	81
PID 892 wrote to memory of 3716	892	wallpaper64.exe	80
PID 892 wrote to memory of 3716	892	wallpaper64.exe	80
PID 404 wrote to memory of 536	404	da.exe	81
PID 536 wrote to memory of 4348	536	calc.exe	83
PID 536 wrote to memory of 4348	536	calc.exe	83

C:\Users\Admin\AppData\Local\Temp\wallpaper64.exe
"C:\Users\Admin\AppData\Local\Temp\wallpaper64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Roaming\da.exe
  "C:\Users\Admin\AppData\Roaming\da.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4348
- C:\Users\Admin\AppData\Roaming\wallpaper64.exe
  "C:\Users\Admin\AppData\Roaming\wallpaper64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

da.exe

Path C:\Users\Admin\AppData\Roaming\da.exe
Size 10.2MB
SHA256 8dbdff238b4fb06633a8373d7a93ada09bbaf8e9a4e14c563af3c6b15857fadf
MD5 6519965c27905dcdd255509b7a064dbb
SHA1 d1854b1b2d2f2cfbb60e1b9b673f0a0554547c27
SHA512 bbe501b52a9794613cf62d993c3d2913e1a8ee6f8647267e2e2d73619a7719b2c210bf09c7557faece468bca13da730584711796e87a0a5ba88bb722ccb20348
SSDEEP 98304:T8KmzsQZVJsGFegdkzhNDV3ZYQdK+4KDpGnVXP2gG:2zsQjKGOeKDp2lug
MD5 SHA1 SHA512 SSDEEP

Submit Download

wallpaper64.exe

Path C:\Users\Admin\AppData\Roaming\wallpaper64.exe
Size 3.9MB
SHA256 a00a16684c28dba6672970feec4b5ecc4474fb7b117d76145679f2f683d46c24
MD5 977122bebdaef266f72a98f9bce624db
SHA1 2c0d341034e6ff2d6a30be63930c345583395f61
SHA512 0935511844021a4b5d30d46290efac69a053c2b6ce0133dd7d928f2104df5a77b3dcadd65172a8d1465a27cccbb727d34de6524dc50a730ca2bb055a2c141fdf
SSDEEP 49152:lKxS0W7uhchrdvyWJkD0wu7V8E71xE57VCnpfFg1w5woNBfjksRxrpwB/OONKUuk:1hhqWOMMCn/woNJksPS5KUuBt+Z
MD5 SHA1 SHA512 SSDEEP