Analysis
- max time kernel
149s - max time network
151s - platform
windows10_x64 - resource
win10v200430 - submitted
26/06/2020, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
UxTheme.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
UxTheme.dll
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target UxTheme.dll
- Size 688KB
- Sample200626-5ksf6h4dds
- SHA256 a7298d680e5a8a36225a1d1fe1b3a250291f31855a02e871e5b02fd5bb76d6be
- MD5 bd496495bd83dbc7930dbc6ad05de670
- SHA1 01248d8c24a336c352e3a05e2c7228d7588e0092
- SHA512 8d7fb71df02d50acdc6994b3878a9536d3210dba9375c75078f96a714d7f0b82a4f218159ad7c0df09dd7dda1dbd3672e707cff3b814e1177cbf8498e626f236
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 2968 Process not Found Token: SeCreatePagefilePrivilege 2968 Process not Found Token: SeShutdownPrivilege 2968 Process not Found Token: SeCreatePagefilePrivilege 2968 Process not Found Token: SeShutdownPrivilege 2968 Process not Found Token: SeCreatePagefilePrivilege 2968 Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DeviceEnroller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sdclt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DeviceEnroller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ywfbribtuthwh = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\ujY6\\sdclt.exe" Process not Found - Suspicious behavior: EnumeratesProcesses 633 IoCs
pid Process 1828 rundll32.exe 1828 rundll32.exe 1828 rundll32.exe 1828 rundll32.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2100 DeviceEnroller.exe 2100 DeviceEnroller.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2552 sdclt.exe 2552 sdclt.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3068 DeviceEnroller.exe 3068 DeviceEnroller.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2968 wrote to memory of 1820 2968 Process not Found 72 PID 2968 wrote to memory of 1820 2968 Process not Found 72 PID 2968 wrote to memory of 2100 2968 Process not Found 73 PID 2968 wrote to memory of 2100 2968 Process not Found 73 PID 2968 wrote to memory of 2468 2968 Process not Found 74 PID 2968 wrote to memory of 2468 2968 Process not Found 74 PID 2968 wrote to memory of 2552 2968 Process not Found 75 PID 2968 wrote to memory of 2552 2968 Process not Found 75 PID 2968 wrote to memory of 2772 2968 Process not Found 76 PID 2968 wrote to memory of 2772 2968 Process not Found 76 PID 2968 wrote to memory of 2840 2968 Process not Found 77 PID 2968 wrote to memory of 2840 2968 Process not Found 77 PID 2968 wrote to memory of 3828 2968 Process not Found 78 PID 2968 wrote to memory of 3828 2968 Process not Found 78 PID 2968 wrote to memory of 3856 2968 Process not Found 79 PID 2968 wrote to memory of 3856 2968 Process not Found 79 PID 2968 wrote to memory of 4056 2968 Process not Found 80 PID 2968 wrote to memory of 4056 2968 Process not Found 80 PID 2968 wrote to memory of 3068 2968 Process not Found 81 PID 2968 wrote to memory of 3068 2968 Process not Found 81 - Executes dropped EXE 5 IoCs
pid Process 2100 DeviceEnroller.exe 2552 sdclt.exe 2840 consent.exe 3856 wermgr.exe 3068 DeviceEnroller.exe - Loads dropped DLL 3 IoCs
pid Process 2100 DeviceEnroller.exe 2552 sdclt.exe 3068 DeviceEnroller.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UxTheme.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1828
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵PID:1820
-
C:\Users\Admin\AppData\Local\weE6jh\DeviceEnroller.exeC:\Users\Admin\AppData\Local\weE6jh\DeviceEnroller.exe1⤵
- Checks whether UAC is enabled
- Executes dropped EXE
- Loads dropped DLL
PID:2100
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵PID:2468
-
C:\Users\Admin\AppData\Local\sriBt\sdclt.exeC:\Users\Admin\AppData\Local\sriBt\sdclt.exe1⤵
- Checks whether UAC is enabled
- Executes dropped EXE
- Loads dropped DLL
PID:2552
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵PID:2772
-
C:\Users\Admin\AppData\Local\neZ\consent.exeC:\Users\Admin\AppData\Local\neZ\consent.exe1⤵
- Executes dropped EXE
PID:2840
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵PID:3828
-
C:\Users\Admin\AppData\Local\KzT5U22\wermgr.exeC:\Users\Admin\AppData\Local\KzT5U22\wermgr.exe1⤵
- Executes dropped EXE
PID:3856
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵PID:4056
-
C:\Users\Admin\AppData\Local\SXFKL\DeviceEnroller.exeC:\Users\Admin\AppData\Local\SXFKL\DeviceEnroller.exe1⤵
- Checks whether UAC is enabled
- Executes dropped EXE
- Loads dropped DLL
PID:3068