Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:15

General

  • Target

    be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe

  • Size

    192KB

  • MD5

    e5f8f6cd43f153b1223a9175fc19e235

  • SHA1

    c5ce77bf08255c036602902b622b895ae90f369d

  • SHA256

    be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694

  • SHA512

    fecacd2cced113bf3749bfd86570fa10e2f42f7f4dceb18d9a2a90fc367476eb5f61d4cb7b3f320eccbffd96a7bc2d81cae81fabf5e74da507f88388690d481a

  • SSDEEP

    3072:qN9AvTqSWPVKBGr8rQmRLjjsskVZK9kCk3mb3Eg2mogLfOsea1YuNPzLHWA9b80l:yhEKolQZKaCm6VXogLf3/bNHjbzl

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe
    "C:\Users\Admin\AppData\Local\Temp\be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" netsh firewall add allowedprogram "C:\Users\Public\Pictures\Blasted.exe" WindowsControl ENABLE & exit
      2⤵
        PID:4608
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Public\Pictures\Blasted.exe" /RL HIGHEST & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Public\Pictures\Blasted.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1444
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Blasted.exe" /RL HIGHEST & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Blasted.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1588
      • C:\Users\Public\Pictures\Blasted.exe
        "C:\Users\Public\Pictures\Blasted.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:5636
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All
          3⤵
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:3680
          • C:\Windows\system32\chcp.com
            chcp 65001
            4⤵
              PID:3528
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              4⤵
              • Loads dropped DLL
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5292
            • C:\Windows\system32\findstr.exe
              findstr All
              4⤵
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:3376
      • C:\Users\Public\Pictures\Blasted.exe
        C:\Users\Public\Pictures\Blasted.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:448
      • C:\Users\Public\Pictures\Blasted.exe
        C:\Users\Public\Pictures\Blasted.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2332

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Blasted.exe.log

        Filesize

        642B

        MD5

        e19ed69089e56bbfaaba5e5e63d0354f

        SHA1

        287519bf7c4ec630e4326db00809f627f927ebef

        SHA256

        f9481e31897c3d9071b744e1638942b52c46858c16ccf692f5c6e109a8b092f6

        SHA512

        c4a8678d28eea4c3a3adfe0324943478efabef839d3bdacb0e4c278e97ee356037c0bfd83b096952b43d81af0b7253eb7d666416e0024ce93a1c516a834fd05b

      • C:\Users\Admin\AppData\Local\Temp\tmpCCDD.tmp.dat

        Filesize

        228KB

        MD5

        ee463e048e56b687d02521cd12788e2c

        SHA1

        ee26598f8e8643df84711960e66a20ecbc6321b8

        SHA256

        3a07b3003758a79a574aa73032076567870389751f2a959537257070da3a10d8

        SHA512

        42b395bf6bd97da800385b9296b63a4b0edd7b3b50dc92f19e61a89235a42d37d204359b57d506e6b25ab95f16625cce035ed3b55ef2d54951c82332498dab0f

      • C:\Users\Admin\AppData\Local\Temp\tmpCCE0.tmp.dat

        Filesize

        130KB

        MD5

        b33d9aa8389eb13e907085a77234e34e

        SHA1

        83935f3310d27e31260821a2f233a77cacf5402e

        SHA256

        bfef543edcd06c1f48237cd4d3a398c1011179efee8d98905e84a734002128d1

        SHA512

        80c2627f65437a929b5a3285bd7291043182938dfd61d06fe653d38ba3fc7e9acf428712ebf4142c27e6523a8e9262d99cad4ec99a74b9da91c0a5b287109bab

      • C:\Users\Public\Pictures\Blasted.exe

        Filesize

        192KB

        MD5

        e5f8f6cd43f153b1223a9175fc19e235

        SHA1

        c5ce77bf08255c036602902b622b895ae90f369d

        SHA256

        be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694

        SHA512

        fecacd2cced113bf3749bfd86570fa10e2f42f7f4dceb18d9a2a90fc367476eb5f61d4cb7b3f320eccbffd96a7bc2d81cae81fabf5e74da507f88388690d481a

      • C:\Windows\xdwd.dll

        Filesize

        136KB

        MD5

        16e5a492c9c6ae34c59683be9c51fa31

        SHA1

        97031b41f5c56f371c28ae0d62a2df7d585adaba

        SHA256

        35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

        SHA512

        20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

      • memory/4268-0-0x00007FF9694D3000-0x00007FF9694D5000-memory.dmp

        Filesize

        8KB

      • memory/4268-1-0x0000000000850000-0x0000000000884000-memory.dmp

        Filesize

        208KB

      • memory/4268-10-0x00007FF9694D0000-0x00007FF969F91000-memory.dmp

        Filesize

        10.8MB

      • memory/4268-24-0x00007FF9694D0000-0x00007FF969F91000-memory.dmp

        Filesize

        10.8MB

      • memory/4268-107-0x00007FF9694D0000-0x00007FF969F91000-memory.dmp

        Filesize

        10.8MB

      • memory/5636-113-0x0000000003130000-0x000000000315A000-memory.dmp

        Filesize

        168KB

      • memory/5636-114-0x000000001D300000-0x000000001D350000-memory.dmp

        Filesize

        320KB