633e4148dd0a0f356835167aa631e117875dbd0ef650808b813801718bdaeeda

General

Target
KomuriClient.exe
Size 171.8MB
Sample260723-qpre4sbb65
SHA256 633e4148dd0a0f356835167aa631e117875dbd0ef650808b813801718bdaeeda
MD5 718fd457356b1cc8ea58f84e977fccb7
SHA1 922edded44ca76cdb4fcc992e42ed96e749d300e
SHA512 13cfebf944425b0d8e0091a65c15c6a8252801efe08a8f362b0f4978be2e818afc2fde28073ad5b56a66613beb5bc0abb7cd0bb00c7dd2e44aac82a7fdfdd448
SSDEEP 1572864:pasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:x4fc/M+i6xCL
TLSH
T114888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4748	javaw.exe
4748	javaw.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
4	discord.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	javaw.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
5	api.ipify.org

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	4748	javaw.exe
Token: SeIncBasePriorityPrivilege	4748	javaw.exe
Token: SeDebugPrivilege	4748	javaw.exe
Token: SeDebugPrivilege	4748	javaw.exe
Token: SeDebugPrivilege	4748	javaw.exe
Token: SeDebugPrivilege	4748	javaw.exe
Token: SeDebugPrivilege	4748	javaw.exe
Token: SeDebugPrivilege	4748	javaw.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4748	javaw.exe
4748	javaw.exe
4748	javaw.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 2228	3136	KomuriClient.exe	81
PID 3136 wrote to memory of 2228	3136	KomuriClient.exe	81
PID 3136 wrote to memory of 4748	3136	KomuriClient.exe	82
PID 4748 wrote to memory of 4092	4748	javaw.exe	83
PID 4748 wrote to memory of 4092	4748	javaw.exe	83
PID 4748 wrote to memory of 1512	4748	javaw.exe	84
PID 4748 wrote to memory of 1512	4748	javaw.exe	84
PID 4748 wrote to memory of 1560	4748	javaw.exe	85
PID 4748 wrote to memory of 1560	4748	javaw.exe	85
PID 4748 wrote to memory of 1652	4748	javaw.exe	86
PID 4748 wrote to memory of 1652	4748	javaw.exe	86
PID 4748 wrote to memory of 3568	4748	javaw.exe	87
PID 4748 wrote to memory of 3568	4748	javaw.exe	87
PID 4748 wrote to memory of 1564	4748	javaw.exe	88
PID 4748 wrote to memory of 1564	4748	javaw.exe	88

C:\Users\Admin\AppData\Local\Temp\KomuriClient.exe
"C:\Users\Admin\AppData\Local\Temp\KomuriClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\KomuriClient.exe
  "C:\Users\Admin\AppData\Local\Temp\KomuriClient.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\KomuriClient" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1676,i,4182848170683005098,4321655575139049283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1668 /prefetch:2
  2⤵
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Djava.awt.headless=false --add-opens java.base/java.lang=ALL-UNNAMED -cp C:\Users\Admin\AppData\Local\Temp\resources\java\866dfdf48836.jar V ira-6a25cf72::default
  2⤵
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

imageio11669272696672427188.tmp

Path C:\Users\Admin\AppData\Local\Temp\imageio11669272696672427188.tmp
Size 87KB
SHA256 c9423ea4572044e83142b1b960c23bb1c4dff9735732d9729e6aa1fa69c53933
MD5 624f085cb9a2d1b616c795e549fbd3c3
SHA1 6a2c479fabd5536c213a913c9077d0300453f676
SHA512 8552e82a08a861307cc57dceb6e92bb9b483a4843255a9a0a410d94b9ecdfb79ebef7b79b1c0c72b222704e1ec994c3747782d61bcb129e63e58e8d364fbe9ae
SSDEEP 1536:FwUsgEgTjspEdydYdcuLnoyYEmixK1KEcSbGcyrpb:XZg6d2ubdYERPzFb
TLSH
T12B93634789449B83A02997E5BE574E9D1F1A2B1CE5D23AFF41274ECB3A213321C8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imageio9888259589879205043.tmp

Path C:\Users\Admin\AppData\Local\Temp\imageio9888259589879205043.tmp
Size 50KB
SHA256 8c5d34f2146669267d63c8a810c26d9843025355221f5cfac80765045bc3c023
MD5 cb532ceab47516f90079ccfb6f82d3ad
SHA1 8113d7ef3b20caf66d091ef7113467d0054e5a74
SHA512 c03d23e0abaae90058507fd3f6fde03b1ea12419ebf519349b19a4413770dde51955bc542fa0ac2be406372b6913a65cf926ea4f2d94ecacf82f14c9fa7bc216
SSDEEP 384:F3j6q9Wvvmu3KREogmzep/xZnTzwWZppe8tKwuq4/5H:F3uqIvvBAEPWep/xh4WZppe/5H
TLSH
T181331B578D488E87F159C7E8FF475DAD6B4A570CF8873AFE05260ECA6F601520C9A03A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna17401917897443103625.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna17401917897443103625.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.42.0.0-f3fd4f75-f789-43c3-9b9e-7ab9caf41ced-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.42.0.0-f3fd4f75-f789-43c3-9b9e-7ab9caf41ced-sqlitejdbc.dll
Size 913KB
SHA256 451e319b14cf9b35b99cca2d245e50e97205b7dcabeeccd8fec6bb54c8a2e84c
MD5 16d165c26c43d841b5ec73d8e0d6fc9d
SHA1 2673a2ed3c7e269abf2b3203cc5bcbb52031f93e
SHA512 694d5261d09a03e1967d41cba5f36a855a0fb9e4684b918ee35d62af9ff671635590f07f1a709de17b7672f2939cdd78f0c0e6c683e90762dbf9e12283c45686
SSDEEP 24576:2inz7OdTCU4Wn4g6eYo3iDU3Ck5bjVPqT39F:/8C84heY05qT3
TLSH
T1D2156C13E39344BDC87BC6B0871FE723B632F48A1134E94F6AA48B642E51E60975F758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\bin\jre\legal\java.net.http\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\bin\jre\legal\java.net.http\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\bin\jre\legal\java.net.http\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

memory/4748-360-0x00007FFC0B6C0000-0x00007FFC0B7AC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads