Analysis
- max time kernel
153s - max time network
162s - platform
windows7_x64 - resource
win7v200430 - submitted
24/06/2020, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
4b1ad896be5b7e954882fce34bd1072b.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4b1ad896be5b7e954882fce34bd1072b.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target 4b1ad896be5b7e954882fce34bd1072b.exe
- Size 1.2MB
- Sample200624-tcdvrfewss
- SHA256 1cc899a5fc4a3e7fe1c9d1265b60a4faf51bc1df3e4b25c088979755410fa954
- MD5 4b1ad896be5b7e954882fce34bd1072b
- SHA1 4ecb0c52aac20465e46e46514f0e23a8bfbf83eb
- SHA512 14f107e3c824f039f1ad910363b098232bb73602b7881fdbf68494901becffe28811ff7943a6b5a1ac5b0f2f34cf4040fbe41de520587b83f1b0c398e1a44d8e
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1424 4b1ad896be5b7e954882fce34bd1072b.exe 1424 4b1ad896be5b7e954882fce34bd1072b.exe 1424 4b1ad896be5b7e954882fce34bd1072b.exe 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1424 4b1ad896be5b7e954882fce34bd1072b.exe 1424 4b1ad896be5b7e954882fce34bd1072b.exe 1424 4b1ad896be5b7e954882fce34bd1072b.exe 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Wyjlhbtb\msd2d8efex.exe mstsc.exe -
description ioc Process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1424 set thread context of 1408 1424 4b1ad896be5b7e954882fce34bd1072b.exe 24 PID 1408 set thread context of 1240 1408 dllhost.exe 20 PID 528 set thread context of 1240 528 mstsc.exe 20 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1408 dllhost.exe 1408 dllhost.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1408 dllhost.exe 1408 dllhost.exe 1408 dllhost.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe 528 mstsc.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer mstsc.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1424 wrote to memory of 1408 1424 4b1ad896be5b7e954882fce34bd1072b.exe 24 PID 1424 wrote to memory of 1408 1424 4b1ad896be5b7e954882fce34bd1072b.exe 24 PID 1424 wrote to memory of 1408 1424 4b1ad896be5b7e954882fce34bd1072b.exe 24 PID 1424 wrote to memory of 1408 1424 4b1ad896be5b7e954882fce34bd1072b.exe 24 PID 1424 wrote to memory of 1408 1424 4b1ad896be5b7e954882fce34bd1072b.exe 24 PID 1424 wrote to memory of 1408 1424 4b1ad896be5b7e954882fce34bd1072b.exe 24 PID 1240 wrote to memory of 528 1240 Explorer.EXE 25 PID 1240 wrote to memory of 528 1240 Explorer.EXE 25 PID 1240 wrote to memory of 528 1240 Explorer.EXE 25 PID 1240 wrote to memory of 528 1240 Explorer.EXE 25 PID 528 wrote to memory of 908 528 mstsc.exe 26 PID 528 wrote to memory of 908 528 mstsc.exe 26 PID 528 wrote to memory of 908 528 mstsc.exe 26 PID 528 wrote to memory of 908 528 mstsc.exe 26 PID 528 wrote to memory of 1588 528 mstsc.exe 31 PID 528 wrote to memory of 1588 528 mstsc.exe 31 PID 528 wrote to memory of 1588 528 mstsc.exe 31 PID 528 wrote to memory of 1588 528 mstsc.exe 31 PID 528 wrote to memory of 1588 528 mstsc.exe 31 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1408 dllhost.exe Token: SeDebugPrivilege 528 mstsc.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1B6HZL08NHOX = "C:\\Program Files (x86)\\Wyjlhbtb\\msd2d8efex.exe" mstsc.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\4b1ad896be5b7e954882fce34bd1072b.exe"C:\Users\Admin\AppData\Local\Temp\4b1ad896be5b7e954882fce34bd1072b.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- System policy modification
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to policy start application
PID:528 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\dllhost.exe"3⤵PID:908
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1588
-
-