Overview

overview

10

Static

static

10

Sample.069...45.exe

windows7_x64

7

Sample.069...45.exe

windows10_x64

7

Analysis

  • max time kernel
    76s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    28-05-2020 22:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Sample.06959.Ref#45.exe

  • Size

    447KB

  • MD5

    d20858e0e22dd33020f396abe5a3cdd0

  • SHA1

    3f094f8e32b39b95ca9a1b4e53bb8ff2c6e7e021

  • SHA256

    2aec5947f09d1e7894dcaa08fc9ee98b5536971cbe543d2e07f4395471ef5c68

  • SHA512

    a79543b4dbfbdd51c95083192a2078fe7c24cf645bd7d2546cf809fc808ecc9b88e60eda6e24921c0ad95faa53d41f74737aa6e32b760f2369b15dd5bc1ea8dc

Score
7/10
spyware

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sample.06959.Ref#45.exe
    "C:\Users\Admin\AppData\Local\Temp\Sample.06959.Ref#45.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mTsguz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBBB0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1028
    • C:\Users\Admin\AppData\Local\Temp\Sample.06959.Ref#45.exe
      "{path}"
      2⤵
        PID:1484
      • C:\Users\Admin\AppData\Local\Temp\Sample.06959.Ref#45.exe
        "{path}"
        2⤵
          PID:660
        • C:\Users\Admin\AppData\Local\Temp\Sample.06959.Ref#45.exe
          "{path}"
          2⤵
            PID:988
          • C:\Users\Admin\AppData\Local\Temp\Sample.06959.Ref#45.exe
            "{path}"
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:984

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Credential Access

        Credentials in Files

        2
        T1081

        Discovery

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpBBB0.tmp
          Download Submit
        • memory/984-1-0x0000000000400000-0x0000000000450000-memory.dmp
          Filesize

          320KB

          Download
        • memory/984-2-0x0000000000400000-0x0000000000450000-memory.dmp
          Filesize

          320KB

          Download
        • memory/984-3-0x0000000000400000-0x0000000000450000-memory.dmp
          Filesize

          320KB

          Download