16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
138s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Text Document mod.exe
Size

8KB
MD5

69994ff2f00eeca9335ccd502198e05b
SHA1

b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256

2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512

ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP

96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	2312	New Text Document mod.exe

Executes dropped EXE 5 IoCs

pid	Process
2208	esco.exe
2316	coinbase.exe
1312	coinbase.tmp
1740	coinbase.exe
1828	coinbase.tmp

Loads dropped DLL 13 IoCs

pid	Process
2208	esco.exe
2208	esco.exe
2208	esco.exe
2316	coinbase.exe
1312	coinbase.tmp
1312	coinbase.tmp
1312	coinbase.tmp
1312	coinbase.tmp
1740	coinbase.exe
1828	coinbase.tmp
1828	coinbase.tmp
1828	coinbase.tmp
2152	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coinbase.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	esco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coinbase.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coinbase.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coinbase.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1828	coinbase.tmp
1828	coinbase.tmp
2208	esco.exe
2208	esco.exe
2208	esco.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	New Text Document mod.exe
Token: SeDebugPrivilege	2208	esco.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1828	coinbase.tmp

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2208	2312	New Text Document mod.exe	33
PID 2312 wrote to memory of 2208	2312	New Text Document mod.exe	33
PID 2312 wrote to memory of 2208	2312	New Text Document mod.exe	33
PID 2312 wrote to memory of 2208	2312	New Text Document mod.exe	33
PID 2312 wrote to memory of 2208	2312	New Text Document mod.exe	33
PID 2312 wrote to memory of 2208	2312	New Text Document mod.exe	33
PID 2312 wrote to memory of 2208	2312	New Text Document mod.exe	33
PID 2312 wrote to memory of 2316	2312	New Text Document mod.exe	34
PID 2312 wrote to memory of 2316	2312	New Text Document mod.exe	34
PID 2312 wrote to memory of 2316	2312	New Text Document mod.exe	34
PID 2312 wrote to memory of 2316	2312	New Text Document mod.exe	34
PID 2312 wrote to memory of 2316	2312	New Text Document mod.exe	34
PID 2312 wrote to memory of 2316	2312	New Text Document mod.exe	34
PID 2312 wrote to memory of 2316	2312	New Text Document mod.exe	34
PID 2316 wrote to memory of 1312	2316	coinbase.exe	35
PID 2316 wrote to memory of 1312	2316	coinbase.exe	35
PID 2316 wrote to memory of 1312	2316	coinbase.exe	35
PID 2316 wrote to memory of 1312	2316	coinbase.exe	35
PID 2316 wrote to memory of 1312	2316	coinbase.exe	35
PID 2316 wrote to memory of 1312	2316	coinbase.exe	35
PID 2316 wrote to memory of 1312	2316	coinbase.exe	35
PID 1312 wrote to memory of 1740	1312	coinbase.tmp	36
PID 1312 wrote to memory of 1740	1312	coinbase.tmp	36
PID 1312 wrote to memory of 1740	1312	coinbase.tmp	36
PID 1312 wrote to memory of 1740	1312	coinbase.tmp	36
PID 1312 wrote to memory of 1740	1312	coinbase.tmp	36
PID 1312 wrote to memory of 1740	1312	coinbase.tmp	36
PID 1312 wrote to memory of 1740	1312	coinbase.tmp	36
PID 1740 wrote to memory of 1828	1740	coinbase.exe	37
PID 1740 wrote to memory of 1828	1740	coinbase.exe	37
PID 1740 wrote to memory of 1828	1740	coinbase.exe	37
PID 1740 wrote to memory of 1828	1740	coinbase.exe	37
PID 1740 wrote to memory of 1828	1740	coinbase.exe	37
PID 1740 wrote to memory of 1828	1740	coinbase.exe	37
PID 1740 wrote to memory of 1828	1740	coinbase.exe	37
PID 1828 wrote to memory of 2152	1828	coinbase.tmp	38
PID 1828 wrote to memory of 2152	1828	coinbase.tmp	38
PID 1828 wrote to memory of 2152	1828	coinbase.tmp	38
PID 1828 wrote to memory of 2152	1828	coinbase.tmp	38
PID 1828 wrote to memory of 2152	1828	coinbase.tmp	38
PID 1828 wrote to memory of 2152	1828	coinbase.tmp	38
PID 1828 wrote to memory of 2152	1828	coinbase.tmp	38

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\a\esco.exe
  "C:\Users\Admin\AppData\Local\Temp\a\esco.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\a\coinbase.exe
  "C:\Users\Admin\AppData\Local\Temp\a\coinbase.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\is-RFDMB.tmp\coinbase.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-RFDMB.tmp\coinbase.tmp" /SL5="$30164,721126,73216,C:\Users\Admin\AppData\Local\Temp\a\coinbase.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\a\coinbase.exe
      "C:\Users\Admin\AppData\Local\Temp\a\coinbase.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\is-MCDT4.tmp\coinbase.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MCDT4.tmp\coinbase.tmp" /SL5="$40164,721126,73216,C:\Users\Admin\AppData\Local\Temp\a\coinbase.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1828
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\netapi32_2.ocx"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEDB0.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\coinbase.exe

Filesize
949KB

MD5
5f41899fe8f7801b20885898e0f4c05a

SHA1
b696ed30844f88392897eb9c0d47cfabcf9ad5f3

SHA256
62f7943a38968bc1d92d0ea08c185bf01b6a8daf5812bb30e25899b9ada0daed

SHA512
c9490f3359df8be70a21e88cc940c3486391fbc089cb026d5570cc235133f63dd6e8dfc6cce8db9dd11cb64d2a5be6d0329abb15713f5bfb37d9c362f9e3220a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RFDMB.tmp\coinbase.tmp

Filesize
711KB

MD5
9917f679a0135245a5cc6b1aadcb3a6c

SHA1
7aab67a56fd3e10fd070e29d2998af2162c0a204

SHA256
a0090b3a687e7d0a6d6b6918bcbb798ebecb184cba8d3eb5fe4345ec9aba9243

SHA512
87194d9f3c97b48a297faef76e3a308de6b454d10a5b50adeb22336982ca5bd5ba3a1cacb39cfbaf78a3befbc37967eb89a7c84cfdd53054204647dffd5b35cd

Download Submit
\Users\Admin\AppData\Local\Temp\is-PRTTV.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-PRTTV.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Roaming\netapi32_2.ocx

Filesize
1.4MB

MD5
c87013ae4715ff280d9f8d2fe749cdba

SHA1
5e7e78ca3d2f799cb9befb0a2f13a1d5636a04af

SHA256
fef9803aa84de828968ffcaebab6050c109147d96420a753b9a6b5d1968ed4bf

SHA512
af9292f763dcd829d3d3d5aa1cd38bae54c2ceb92572f231ede1793e303173f3ba7eef17fe167a0fdc7dd25a9869bd18da4d9e3cb5c75573f1edb6ff1f2e5aaf

Download Submit
memory/1312-103-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1740-106-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1740-134-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1828-133-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2208-73-0x0000000001290000-0x0000000002290000-memory.dmp

Filesize
16.0MB

Download
memory/2208-137-0x0000000000470000-0x0000000000496000-memory.dmp

Filesize
152KB

Download
memory/2312-63-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2312-62-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/2312-2-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2312-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/2312-1-0x0000000000D60000-0x0000000000D68000-memory.dmp

Filesize
32KB

Download
memory/2316-79-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2316-105-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download