Analysis
- max time kernel
150s - max time network
154s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
Afy8NqgmRehaIKs.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Afy8NqgmRehaIKs.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Afy8NqgmRehaIKs.exe
- Size 288KB
- Sample200624-9grrceze1a
- SHA256 ca6d30359259e4b3387ea8cde986038557c85550fe9d2eadfc5bf40777fb2cfb
- MD5 f27f6355c8e7e99d93d2706b789346d4
- SHA1 30d8c2f98cdaae390e51357c96695ba4ec5f22bd
- SHA512 094d31d295de185032aecb7b3858af167f3126ad0690baf7239c8b207e897b02e9965b816ea1adbf36cd1bd41b0f657bc9d9933b1aa00b923d1cd13e2d410ebd
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3132 Afy8NqgmRehaIKs.exe 3132 Afy8NqgmRehaIKs.exe 3132 Afy8NqgmRehaIKs.exe 3132 Afy8NqgmRehaIKs.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3132 Afy8NqgmRehaIKs.exe 3132 Afy8NqgmRehaIKs.exe 3132 Afy8NqgmRehaIKs.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe 4092 cmmon32.exe - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmmon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BXQLEFW = "C:\\Program Files (x86)\\Ecjd\\7n88c2kqz7plz.exe" cmmon32.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1688 wrote to memory of 3132 1688 Afy8NqgmRehaIKs.exe 72 PID 1688 wrote to memory of 3132 1688 Afy8NqgmRehaIKs.exe 72 PID 1688 wrote to memory of 3132 1688 Afy8NqgmRehaIKs.exe 72 PID 1688 wrote to memory of 3132 1688 Afy8NqgmRehaIKs.exe 72 PID 1688 wrote to memory of 3132 1688 Afy8NqgmRehaIKs.exe 72 PID 1688 wrote to memory of 3132 1688 Afy8NqgmRehaIKs.exe 72 PID 2952 wrote to memory of 4092 2952 Explorer.EXE 73 PID 2952 wrote to memory of 4092 2952 Explorer.EXE 73 PID 2952 wrote to memory of 4092 2952 Explorer.EXE 73 PID 4092 wrote to memory of 3692 4092 cmmon32.exe 74 PID 4092 wrote to memory of 3692 4092 cmmon32.exe 74 PID 4092 wrote to memory of 3692 4092 cmmon32.exe 74 PID 4092 wrote to memory of 3872 4092 cmmon32.exe 76 PID 4092 wrote to memory of 3872 4092 cmmon32.exe 76 PID 4092 wrote to memory of 3872 4092 cmmon32.exe 76 PID 4092 wrote to memory of 3484 4092 cmmon32.exe 78 PID 4092 wrote to memory of 3484 4092 cmmon32.exe 78 PID 4092 wrote to memory of 3484 4092 cmmon32.exe 78 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1688 set thread context of 3132 1688 Afy8NqgmRehaIKs.exe 72 PID 3132 set thread context of 2952 3132 Afy8NqgmRehaIKs.exe 56 PID 4092 set thread context of 2952 4092 cmmon32.exe 56 - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3132 Afy8NqgmRehaIKs.exe Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeDebugPrivilege 4092 cmmon32.exe Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ecjd\7n88c2kqz7plz.exe cmmon32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\Afy8NqgmRehaIKs.exe"C:\Users\Admin\AppData\Local\Temp\Afy8NqgmRehaIKs.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\Afy8NqgmRehaIKs.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Adds Run entry to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
PID:4092 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Afy8NqgmRehaIKs.exe"3⤵PID:3692
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3872
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3484
-
-