Overview
overview
10Static
static
10e64b687735...eb.exe
windows7-x64
8e64b687735...eb.exe
windows10-2004-x64
8e65dc6f84e...10.exe
windows7-x64
10e65dc6f84e...10.exe
windows10-2004-x64
10e67e28bf49...ac.exe
windows7-x64
10e67e28bf49...ac.exe
windows10-2004-x64
10e699919d5d...ad.exe
windows7-x64
3e699919d5d...ad.exe
windows10-2004-x64
3e70b65e1d8...21.exe
windows7-x64
10e70b65e1d8...21.exe
windows10-2004-x64
10e7193d3473...84.exe
windows7-x64
10e7193d3473...84.exe
windows10-2004-x64
10e740e379c5...b9.exe
windows7-x64
10e740e379c5...b9.exe
windows10-2004-x64
10e751c36e12...39.exe
windows7-x64
1e751c36e12...39.exe
windows10-2004-x64
1e7573bcf85...a1.exe
windows7-x64
7e7573bcf85...a1.exe
windows10-2004-x64
7e787228874...9b.exe
windows7-x64
10e787228874...9b.exe
windows10-2004-x64
10e80000db8c...4b.exe
windows7-x64
10e80000db8c...4b.exe
windows10-2004-x64
10e82aaf456a...e7.exe
windows7-x64
10e82aaf456a...e7.exe
windows10-2004-x64
10e864953c3a...53.exe
windows7-x64
10e864953c3a...53.exe
windows10-2004-x64
10e8686658e2...12.exe
windows7-x64
3e8686658e2...12.exe
windows10-2004-x64
3e8add32344...f4.exe
windows7-x64
10e8add32344...f4.exe
windows10-2004-x64
10e8cdbe10bd...14.exe
windows7-x64
10e8cdbe10bd...14.exe
windows10-2004-x64
10Analysis
- max time kernel
104s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system - submitted
22/03/2025, 06:18
Behavioral task
behavioral1
Sample
e64b687735f08d83a710e6e493346feb.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
e64b687735f08d83a710e6e493346feb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
e67e28bf496e7f9625bf94a126253aac.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
e67e28bf496e7f9625bf94a126253aac.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
e699919d5d4dee2a70455861a6aeddad.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
e699919d5d4dee2a70455861a6aeddad.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
e70b65e1d80063b1fdfc5b439f8ec121.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
e70b65e1d80063b1fdfc5b439f8ec121.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
e7193d347375dbb471134f1772410284.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral12
Sample
e7193d347375dbb471134f1772410284.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
e7573bcf859fd192353ba79f43e0cca1.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
e7573bcf859fd192353ba79f43e0cca1.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
e787228874f75520e2a95df7768ba99b.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral20
Sample
e787228874f75520e2a95df7768ba99b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
e864953c3a95b063ace86177e1914753.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral26
Sample
e864953c3a95b063ace86177e1914753.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
e8686658e2163a23de75fe75807e0d12.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
e8686658e2163a23de75fe75807e0d12.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral30
Sample
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
e8cdbe10bd3316f1f52cfd57c431f914.exe
Resource
win7-20241010-en
windows7-x64
General
- Target e64b687735f08d83a710e6e493346feb.exe
- Size 228KB
- Sample250322-g2knnatkt2
- SHA256 c5527f31480ac48e227122ccc4239db78bf3094bbbba6f6e1dd6c30e788ac7ae
- MD5 e64b687735f08d83a710e6e493346feb
- SHA1 42330b4138ce8d74ddf94ccde3cf56678aea4c78
- SHA512 f51fb52208429fc9b97881f23d34145bf06a9526827c1ce19240fbf21b1627d0d9b6012584c98ce432a72470fcf33a7e3ec344085f1c83822f29f6accb8846c1
- SSDEEP 6144:RPTRtufdY7vzXpjYgV53GUEMlqJ8eFNL++y:MG7vzZXW+4NH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 212 powershell.exe 4476 powershell.exe 5076 powershell.exe 980 powershell.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 26 discord.com 28 discord.com - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 ip-api.com - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4776 cmd.exe 1880 PING.EXE - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 5064 wmic.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1880 PING.EXE - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 212 powershell.exe 212 powershell.exe 4476 powershell.exe 4476 powershell.exe 5076 powershell.exe 5076 powershell.exe 4672 powershell.exe 4672 powershell.exe 980 powershell.exe 980 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3920 e64b687735f08d83a710e6e493346feb.exe Token: SeDebugPrivilege 212 powershell.exe Token: SeDebugPrivilege 4476 powershell.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeDebugPrivilege 4672 powershell.exe Token: SeIncreaseQuotaPrivilege 4352 wmic.exe Token: SeSecurityPrivilege 4352 wmic.exe Token: SeTakeOwnershipPrivilege 4352 wmic.exe Token: SeLoadDriverPrivilege 4352 wmic.exe Token: SeSystemProfilePrivilege 4352 wmic.exe Token: SeSystemtimePrivilege 4352 wmic.exe Token: SeProfSingleProcessPrivilege 4352 wmic.exe Token: SeIncBasePriorityPrivilege 4352 wmic.exe Token: SeCreatePagefilePrivilege 4352 wmic.exe Token: SeBackupPrivilege 4352 wmic.exe Token: SeRestorePrivilege 4352 wmic.exe Token: SeShutdownPrivilege 4352 wmic.exe Token: SeDebugPrivilege 4352 wmic.exe Token: SeSystemEnvironmentPrivilege 4352 wmic.exe Token: SeRemoteShutdownPrivilege 4352 wmic.exe Token: SeUndockPrivilege 4352 wmic.exe Token: SeManageVolumePrivilege 4352 wmic.exe Token: 33 4352 wmic.exe Token: 34 4352 wmic.exe Token: 35 4352 wmic.exe Token: 36 4352 wmic.exe Token: SeIncreaseQuotaPrivilege 4352 wmic.exe Token: SeSecurityPrivilege 4352 wmic.exe Token: SeTakeOwnershipPrivilege 4352 wmic.exe Token: SeLoadDriverPrivilege 4352 wmic.exe Token: SeSystemProfilePrivilege 4352 wmic.exe Token: SeSystemtimePrivilege 4352 wmic.exe Token: SeProfSingleProcessPrivilege 4352 wmic.exe Token: SeIncBasePriorityPrivilege 4352 wmic.exe Token: SeCreatePagefilePrivilege 4352 wmic.exe Token: SeBackupPrivilege 4352 wmic.exe Token: SeRestorePrivilege 4352 wmic.exe Token: SeShutdownPrivilege 4352 wmic.exe Token: SeDebugPrivilege 4352 wmic.exe Token: SeSystemEnvironmentPrivilege 4352 wmic.exe Token: SeRemoteShutdownPrivilege 4352 wmic.exe Token: SeUndockPrivilege 4352 wmic.exe Token: SeManageVolumePrivilege 4352 wmic.exe Token: 33 4352 wmic.exe Token: 34 4352 wmic.exe Token: 35 4352 wmic.exe Token: 36 4352 wmic.exe Token: SeIncreaseQuotaPrivilege 3616 wmic.exe Token: SeSecurityPrivilege 3616 wmic.exe Token: SeTakeOwnershipPrivilege 3616 wmic.exe Token: SeLoadDriverPrivilege 3616 wmic.exe Token: SeSystemProfilePrivilege 3616 wmic.exe Token: SeSystemtimePrivilege 3616 wmic.exe Token: SeProfSingleProcessPrivilege 3616 wmic.exe Token: SeIncBasePriorityPrivilege 3616 wmic.exe Token: SeCreatePagefilePrivilege 3616 wmic.exe Token: SeBackupPrivilege 3616 wmic.exe Token: SeRestorePrivilege 3616 wmic.exe Token: SeShutdownPrivilege 3616 wmic.exe Token: SeDebugPrivilege 3616 wmic.exe Token: SeSystemEnvironmentPrivilege 3616 wmic.exe Token: SeRemoteShutdownPrivilege 3616 wmic.exe Token: SeUndockPrivilege 3616 wmic.exe Token: SeManageVolumePrivilege 3616 wmic.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3920 wrote to memory of 1368 3920 e64b687735f08d83a710e6e493346feb.exe 88 PID 3920 wrote to memory of 1368 3920 e64b687735f08d83a710e6e493346feb.exe 88 PID 3920 wrote to memory of 212 3920 e64b687735f08d83a710e6e493346feb.exe 90 PID 3920 wrote to memory of 212 3920 e64b687735f08d83a710e6e493346feb.exe 90 PID 3920 wrote to memory of 4476 3920 e64b687735f08d83a710e6e493346feb.exe 92 PID 3920 wrote to memory of 4476 3920 e64b687735f08d83a710e6e493346feb.exe 92 PID 3920 wrote to memory of 5076 3920 e64b687735f08d83a710e6e493346feb.exe 94 PID 3920 wrote to memory of 5076 3920 e64b687735f08d83a710e6e493346feb.exe 94 PID 3920 wrote to memory of 4672 3920 e64b687735f08d83a710e6e493346feb.exe 96 PID 3920 wrote to memory of 4672 3920 e64b687735f08d83a710e6e493346feb.exe 96 PID 3920 wrote to memory of 4352 3920 e64b687735f08d83a710e6e493346feb.exe 101 PID 3920 wrote to memory of 4352 3920 e64b687735f08d83a710e6e493346feb.exe 101 PID 3920 wrote to memory of 3616 3920 e64b687735f08d83a710e6e493346feb.exe 104 PID 3920 wrote to memory of 3616 3920 e64b687735f08d83a710e6e493346feb.exe 104 PID 3920 wrote to memory of 1060 3920 e64b687735f08d83a710e6e493346feb.exe 106 PID 3920 wrote to memory of 1060 3920 e64b687735f08d83a710e6e493346feb.exe 106 PID 3920 wrote to memory of 980 3920 e64b687735f08d83a710e6e493346feb.exe 108 PID 3920 wrote to memory of 980 3920 e64b687735f08d83a710e6e493346feb.exe 108 PID 3920 wrote to memory of 5064 3920 e64b687735f08d83a710e6e493346feb.exe 111 PID 3920 wrote to memory of 5064 3920 e64b687735f08d83a710e6e493346feb.exe 111 PID 3920 wrote to memory of 4776 3920 e64b687735f08d83a710e6e493346feb.exe 114 PID 3920 wrote to memory of 4776 3920 e64b687735f08d83a710e6e493346feb.exe 114 PID 4776 wrote to memory of 1880 4776 cmd.exe 116 PID 4776 wrote to memory of 1880 4776 cmd.exe 116 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1368 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e64b687735f08d83a710e6e493346feb.exe"C:\Users\Admin\AppData\Local\Temp\e64b687735f08d83a710e6e493346feb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\e64b687735f08d83a710e6e493346feb.exe"2⤵
- Views/modifies file attributes
PID:1368
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4672
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3616
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:980
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:5064
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\e64b687735f08d83a710e6e493346feb.exe" && pause2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1880
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 6aa59e171898b3dd42a36662ef81d349ce5063a705f1261e881269c59e7c742b
- MD5 737aca23f199ce589dd1e68bc4969b98
- SHA1 8c9cdd6bdf94c5fa42c5b0c29abf0136e4e6fa00
- SHA512 ccc0e6fa798aeb92e6e1a14d6ef3dc23e8e829d5ffd10f11129d0e590820711e29997a761dca77b8e790b06e3c7c0d2059137f40f92543eb8048529b1b4d7817
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 948B
- SHA256 60c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04
- MD5 74a6b79d36b4aae8b027a218bc6e1af7
- SHA1 0350e46c1df6934903c4820a00b0bc4721779e5f
- SHA512 60e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5d139a221345fe53f28d2a772c8e4c8e988925b6fc228c81baa98f824a44c67c
- MD5 4950bb37b35849b09a86bc7c01c8952a
- SHA1 f9650f41d105d3affa7b19d58ab336a92aab4793
- SHA512 5b39b845d6d53acd9a20fa1e3e081f7a4c5bbea4641ed53e6d1df8fb245a57e7a659cbdbdfe41ce642b6b2a7ff98b3dd3c9a5bcea7d226cead546d097f361a40
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f91341354f99f965d4737a54743ca914531391e5c03005020ace74f8c536c0e0
- MD5 f69437dfc5b7cb5d7422d4557c5193a1
- SHA1 2ad54bbf836fa97a9386a6b251c5d769a6d2badb
- SHA512 993fe382cbd8b978e06e6e5870757959b6944d70a4e6bf97420039b20dd6f1a566545cc271b28bcb5795205d4e8ea6ce1ef4effe6ccd45d909c2560e867ccc3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sx0sjhrl.kjg.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512