Analysis
- max time kernel
146s - max time network
145s - platform
windows7_x64 - resource
win7 - submitted
24/06/2020, 14:54
Static task
static1
Behavioral task
behavioral1
Sample
products samples.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
products samples.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target products samples.exe
- Size 494KB
- Sample200624-mgwp9rha46
- SHA256 cbb6d89187847aab1fcff6b5d832ea80bca30bfe5520702133cab83335392ead
- MD5 e64f048c8c196195443a74e911748666
- SHA1 42d24e14f852afba26c793bf4063ad80f581452a
- SHA512 0101a9d60cfbf7dbabf5e7c3d119c12bd5774926387fb51606e5715ee80554c8311b5bc2060e4a329199a696799a593b8a7b4af9315c06a009228e3832e56f75
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1156 wrote to memory of 1372 1156 products samples.exe 26 PID 1224 wrote to memory of 1952 1224 Explorer.EXE 27 PID 1224 wrote to memory of 1952 1224 Explorer.EXE 27 PID 1224 wrote to memory of 1952 1224 Explorer.EXE 27 PID 1224 wrote to memory of 1952 1224 Explorer.EXE 27 PID 1952 wrote to memory of 1928 1952 NETSTAT.EXE 28 PID 1952 wrote to memory of 1928 1952 NETSTAT.EXE 28 PID 1952 wrote to memory of 1928 1952 NETSTAT.EXE 28 PID 1952 wrote to memory of 1928 1952 NETSTAT.EXE 28 PID 1952 wrote to memory of 1928 1952 NETSTAT.EXE 28 - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1372 ieinstal.exe 1372 ieinstal.exe 1372 ieinstal.exe 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NETSTAT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\JRWX0ZIXGV = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" NETSTAT.EXE - Adds Run entry to policy start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run NETSTAT.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1372 ieinstal.exe 1372 ieinstal.exe 1156 products samples.exe 1156 products samples.exe 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE 1952 NETSTAT.EXE - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1372 ieinstal.exe Token: SeDebugPrivilege 1952 NETSTAT.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1372 set thread context of 1224 1372 ieinstal.exe 20 PID 1952 set thread context of 1224 1952 NETSTAT.EXE 20 - Legitimate hosting services abused for malware hosting/C2 1 TTPs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\products samples.exe"C:\Users\Admin\AppData\Local\Temp\products samples.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1156 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1372
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Adds Run entry to start application
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1952 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1928
-
-