Analysis
-
max time kernel
101s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
16/06/2020, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
Badboymnb.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Badboymnb.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Badboymnb.exe
-
Size
23KB
-
MD5
0bf3158979d38b3d3c99ccfa5b1b4a83
-
SHA1
f8eb3e0ab7f09eb93125afa11d5c793f55e1c607
-
SHA256
c49eb3f83f94347d223338a13a2a57387ac689dc16d64f3d41a251b3a3325e5d
-
SHA512
938b82fde3e7bddb96948d9548ebd325dd63fb01292a8a8fcb22e102b51bee66143be21d24c18d9e9a6b6c2518e82992e056fccf4fa7492938ffe8848bcc096a
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Badboymnb.exe -
Drops desktop.ini file(s) 45 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Badboymnb.exe File created C:\Users\Admin\Contacts\desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini Badboymnb.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Badboymnb.exe File created C:\Users\Admin\Favorites\desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Badboymnb.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini Badboymnb.exe File created C:\Users\Admin\Pictures\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Badboymnb.exe File created C:\Users\Admin\Links\desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Badboymnb.exe File created C:\Users\Admin\Favorites\Links\desktop.ini Badboymnb.exe File created C:\Users\Admin\Searches\desktop.ini Badboymnb.exe File created C:\Users\Admin\Desktop\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Badboymnb.exe File created C:\Users\Admin\OneDrive\desktop.ini Badboymnb.exe File created C:\Users\Admin\Documents\desktop.ini Badboymnb.exe File created C:\Users\Admin\Music\desktop.ini Badboymnb.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini Badboymnb.exe File created C:\Users\Admin\Downloads\desktop.ini Badboymnb.exe File created C:\Users\Admin\Videos\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Badboymnb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Badboymnb.exe File created C:\Users\Admin\Saved Games\desktop.ini Badboymnb.exe File created C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini Badboymnb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Badboymnb.exe"C:\Users\Admin\AppData\Local\Temp\Badboymnb.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
PID:3908
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1592