Analysis
-
max time kernel
128s -
max time network
149s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
11-06-2020 07:42
Static task
static1
Behavioral task
behavioral1
Sample
00b2679e73e28343fd153df9858bc910.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
00b2679e73e28343fd153df9858bc910.exe
Resource
win10v200430
General
-
Target
00b2679e73e28343fd153df9858bc910.exe
-
Size
715KB
-
MD5
00b2679e73e28343fd153df9858bc910
-
SHA1
f27390cdca4afea0ffeda89f117931858e7f5a7f
-
SHA256
6396ea2ef48aa3d3a61fb2e1ca50ac3711c376ec2b67dbaf64eeba49f5dfa9df
-
SHA512
35b06555bd088bdcdd13f3377832073ebdae9053fe8a640c41470560da1f093abe65d6cfc4cfce30a9af708a8926ea646c801b6c155d0517e612f807472a7261
Malware Config
Extracted
C:\odt\!!FAQ for Decryption!!.txt
mrddnet_support@protonmail.ch
Signatures
-
Drops file in Program Files directory 16122 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\program files\java\jre1.8.0_66\lib\jfr.jar svchost.exe File opened for modification C:\program files\windowsapps\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\assets\getstartedapplist.targetsize-16_altform-unplated_contrast-black.png svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\homebanner_light.pdf svchost.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\pl-pl\!!FAQ for Decryption!!.txt svchost.exe File opened for modification C:\program files\windowsapps\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\assets\getstartedapplist.targetsize-64_altform-unplated_contrast-white.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\assets\themes\jumbo\mask\13d.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\assets\calculatorapplist.scale-200.png svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js svchost.exe File opened for modification C:\program files (x86)\common files\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\info.plist svchost.exe File created C:\program files\windowsapps\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\assets\mainpagestate2\!!FAQ for Decryption!!.txt svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\assets\photoslogoextensions.targetsize-40.png svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\s_cancel_18.svg svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\assets\insiderhubapplist.targetsize-48_contrast-black.png svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\illustrations.png svchost.exe File opened for modification C:\program files\java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif svchost.exe File created C:\program files\videolan\vlc\locale\be\lc_messages\!!FAQ for Decryption!!.txt svchost.exe File opened for modification C:\program files\windowsapps\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\appxblockmap.xml svchost.exe File opened for modification C:\program files\windowsapps\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\assets\pdp\paint_pdp.xml svchost.exe File opened for modification C:\program files (x86)\common files\system\msadc\en-us\msdaprsr.dll.mui svchost.exe File opened for modification C:\program files\windowsapps\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\assets\manifestassets\contrast-black\icon.targetsize-48.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\assets\themes\jumbo\jumbo_1s.png svchost.exe File opened for modification C:\program files (x86)\windowspowershell\modules\pester\3.4.0\functions\assertions\belikeexactly.tests.ps1 svchost.exe File opened for modification C:\program files\windowsapps\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\assets\apptiles\weathericons\30x30\171.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-white\peoplewidetile.scale-125.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\skypeapp\designs\flags\small\dk_16x11.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5601_48x48x32.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\assets\applist.targetsize-16_altform-unplated.png svchost.exe File created C:\program files\windowsapps\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\assets\contrast-white\!!FAQ for Decryption!!.txt svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1851_40x40x32.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\outlookmailwidetile.scale-125.png svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\pages-app\images\example_icons2x.png svchost.exe File opened for modification C:\program files\java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar svchost.exe File opened for modification C:\program files\windowsapps\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\appxblockmap.xml svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\js\nls\en-ae\ui-strings.js svchost.exe File opened for modification C:\program files\java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\meta-inf\eclipse_.rsa svchost.exe File opened for modification C:\program files\windowsapps\deletedalluserpackages\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x svchost.exe File created C:\program files\windowsapps\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\!!FAQ for Decryption!!.txt svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\assets\insiderhubapplist.targetsize-16_altform-unplated_contrast-black.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\assets\themecreation\cancel.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\appxmetadata\appxbundlemanifest.xml svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js svchost.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\app-center\js\nls\sk-sk\!!FAQ for Decryption!!.txt svchost.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\!!FAQ for Decryption!!.txt svchost.exe File opened for modification C:\program files\7-zip\lang\ko.txt svchost.exe File opened for modification C:\program files\windowsapps\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\assets\awards\spider\2_piece_silk_suit_.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7834_24x24x32.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\assets\voicerecorderapplist.contrast-black_targetsize-72_altform-unplated.png svchost.exe File opened for modification C:\program files\windowsapps\deletedalluserpackages\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\secondarytiles\work\largetile.scale-125.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\assets\icons\tripeaks_menu_icon.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\exchangesmalltile.scale-200.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\hxcalendarapplist.targetsize-60.png svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png svchost.exe File opened for modification C:\program files\common files\microsoft shared\ink\fsdefinitions\symbols.xml svchost.exe File created C:\program files\common files\system\msadc\en-us\!!FAQ for Decryption!!.txt svchost.exe File created C:\program files\windowsapps\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\arkadium.win10.starclub\assets\pin\!!FAQ for Decryption!!.txt svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png svchost.exe File opened for modification C:\program files\windowsapps\deletedalluserpackages\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\skypeapp\assets\lockscreenbadgelogo.scale-125.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\assets\manifestassets\contrast-white\square44x44logo.targetsize-24_altform-unplated.png svchost.exe File opened for modification C:\program files\windowsapps\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\assets\thankyou\genericintl-1.jpg svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\idtemplates\enu\adobeid.pdf svchost.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\selector.js svchost.exe File opened for modification C:\program files (x86)\msbuild\microsoft\windows workflow foundation\v3.5\workflow.targets svchost.exe File opened for modification C:\program files\windowsapps\deletedalluserpackages\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\apptiles\contrast-white\mapswidetile.scale-125.png svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
00b2679e73e28343fd153df9858bc910.exedescription pid process target process PID 3264 wrote to memory of 1824 3264 00b2679e73e28343fd153df9858bc910.exe svchost.exe PID 3264 wrote to memory of 1824 3264 00b2679e73e28343fd153df9858bc910.exe svchost.exe PID 3264 wrote to memory of 1824 3264 00b2679e73e28343fd153df9858bc910.exe svchost.exe PID 3264 wrote to memory of 1824 3264 00b2679e73e28343fd153df9858bc910.exe svchost.exe PID 3264 wrote to memory of 1824 3264 00b2679e73e28343fd153df9858bc910.exe svchost.exe PID 3264 wrote to memory of 2100 3264 00b2679e73e28343fd153df9858bc910.exe cmd.exe PID 3264 wrote to memory of 2100 3264 00b2679e73e28343fd153df9858bc910.exe cmd.exe PID 3264 wrote to memory of 2100 3264 00b2679e73e28343fd153df9858bc910.exe cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
00b2679e73e28343fd153df9858bc910.exedescription pid process target process PID 3264 set thread context of 1824 3264 00b2679e73e28343fd153df9858bc910.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
svchost.exepid process 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00b2679e73e28343fd153df9858bc910.exe"C:\Users\Admin\AppData\Local\Temp\00b2679e73e28343fd153df9858bc910.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe/c del C:\Users\Admin\AppData\Local\Temp\00b2679e73e28343fd153df9858bc910.exe >> NUL2⤵