b3cc4e1f09aa77a31e7071f2a505bfe5f13f9ec3cb73997b0d4a5ac36fc710fa

Analysis

max time kernel
96s
max time network
153s
platform
windows10_x64
resource
win10v200217
submitted
20-02-2020 07:05

Sharing

Copy URL

Twitter E-mail

General

Target

SOA JAN 2020.exe
Size

72KB
MD5

c4621eec483d53149a3be009e66feff7
SHA1

c5156341e4726e5a11a536146506af62ed3e62bd
SHA256

ab7049214198281d0effceb67875bebbbc022a55f9e6a2960ac71b0c1f2acebe
SHA512

320515628b7e48c5899a44f5ec59a937c6e6e6d5f4baaafbfdff0e6fbdb56d91ec096a1e573d55873ff1d43ea91fff2a54716059fba1ee7cd69cd74ba5a6cd7d

Score

6^/10

evasion spyware trojan

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

SOA JAN 2020.exeRegAsm.exe

pid process

3100 SOA JAN 2020.exe
972 RegAsm.exe
972 RegAsm.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

SOA JAN 2020.exe

pid process

3100 SOA JAN 2020.exe
3100 SOA JAN 2020.exe
3100 SOA JAN 2020.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

SOA JAN 2020.exe

description pid process target process

PID 3100 set thread context of 972 3100 SOA JAN 2020.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 972 RegAsm.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegAsm.exe

pid process

972 RegAsm.exe
972 RegAsm.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SOA JAN 2020.exeRegAsm.exe

pid process

3100 SOA JAN 2020.exe
972 RegAsm.exe

pid	process
3100	SOA JAN 2020.exe
972	RegAsm.exe
972	RegAsm.exe

pid	process
3100	SOA JAN 2020.exe
3100	SOA JAN 2020.exe
3100	SOA JAN 2020.exe

description	pid	process	target process
PID 3100 set thread context of 972	3100	SOA JAN 2020.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	972	RegAsm.exe

pid	process
972	RegAsm.exe
972	RegAsm.exe

pid	process
3100	SOA JAN 2020.exe
972	RegAsm.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

SOA JAN 2020.exe

description	pid	process	target process
PID 3100 wrote to memory of 4064	3100	SOA JAN 2020.exe	RegAsm.exe
PID 3100 wrote to memory of 4064	3100	SOA JAN 2020.exe	RegAsm.exe
PID 3100 wrote to memory of 4064	3100	SOA JAN 2020.exe	RegAsm.exe
PID 3100 wrote to memory of 1000	3100	SOA JAN 2020.exe	RegAsm.exe
PID 3100 wrote to memory of 1000	3100	SOA JAN 2020.exe	RegAsm.exe
PID 3100 wrote to memory of 1000	3100	SOA JAN 2020.exe	RegAsm.exe
PID 3100 wrote to memory of 972	3100	SOA JAN 2020.exe	RegAsm.exe
PID 3100 wrote to memory of 972	3100	SOA JAN 2020.exe	RegAsm.exe
PID 3100 wrote to memory of 972	3100	SOA JAN 2020.exe	RegAsm.exe
PID 3100 wrote to memory of 972	3100	SOA JAN 2020.exe	RegAsm.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob = 5c0000000100000004000000000800000f0000000100000014000000bf4d2c390bbf0aa3a2b7ea2dc751011bf5fd422e090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000005c00000047006f006f0067006c00650020005400720075007300740020005300650072007600690063006500730020002d00200047006c006f00620061006c005300690067006e00200052006f006f0074002000430041002d005200320000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0620000000100000020000000ca42dd41745fd0b81eb902362cf9d8bf719da1bd1b1efc946f5b4c99f42c1b9e1400000001000000140000009be20757671c1ec06a06de59b49a2ddfdc19862e1d000000010000001000000073621e116224668780b2d2bee454e52e7f000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d50103000000010000001400000075e0abb6138512271c04f85fddde38e4b7242efe190000000100000010000000a8827a3cbd2d87d783b59b8062c87e9a2000000001000000be030000308203ba308202a2a003020102020b0400000000010f8626e60d300d06092a864886f70d0101050500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3036313231353038303030305a170d3231313231353038303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a6cf240ebe2e6f28994542c4ab3e21549b0bd37f8470fa12b3cbbf875fc67f86d3b2305cd6fdadf17bdce5f86096099210f5d053defb7b7e7388ac52887b4aa6ca49a65ea8a78c5a11bc7a82ebbe8ce9b3ac962507974a992a072fb41e77bf8a0fb5027c1b96b8c5b93a2cbcd612b9eb597de2d006865f5e496ab5395e8834ecbc780c0898846ca8cd4bb4a07d0c794df0b82dcb21cad56c5b7de1a02984a1f9d39449cb24629120bcdd0bd5d9ccf9ea270a2b7391c69d1bacc8cbe8e0a0f42f908b4dfbb0361bf6197a85e06df26113885c9fe0930a51978a5aceafabd5f7aa09aa60bddcd95fdf72a960135e0001c94afa3fa4ea070321028e82ca03c29b8f0203010001a3819c308199300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604149be20757671c1ec06a06de59b49a2ddfdc19862e30360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742d72322e63726c301f0603551d230418301680149be20757671c1ec06a06de59b49a2ddfdc19862e300d06092a864886f70d01010505000382010100998153871c68978691ece04ab8440bab81ac274fd6c1b81c4378b30c9afcea2c3c6e611b4d4b29f59f051d26c1b8e983006245b6a90893b9a9334b189ac2f887884edbdd71341ac154da463fe0d32aab6d5422f53a62cd206fba2989d7dd91eed35ca23ea15b41f5dfe564432de9d539abd2a2dfb78bd0c080191c45c02d8ce8f82da4745649c505b54f15de6e44783987a87ebbf3791891bbf46f9dc1f08c358c5d01fbc36db9ef446d7946317e0afea982c1ffefab6e20c450c95f9d4d9b178c0ce501c9a0416a7353faa550b46e250ffb4c18f4fd52d98e69b1e8110fde88d8fb1d49f7aade95cf2078c26012db25408c6afc7e4238406412f79e81e1932e	RegAsm.exe

Reads browser user data or profiles (possible credential harvesting) 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\SOA JAN 2020.exe
"C:\Users\Admin\AppData\Local\Temp\SOA JAN 2020.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\SOA JAN 2020.exe"
2⤵
PID:4064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\SOA JAN 2020.exe"
2⤵
PID:1000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\SOA JAN 2020.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Modifies system certificate store
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-2-0x000000007FAF0000-0x000000007FEA1000-memory.dmp

Filesize
3.7MB

Download