Analysis
- max time kernel
149s - max time network
141s - platform
windows10_x64 - resource
win10v200430 - submitted
28/06/2020, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
specification quote.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
specification quote.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target specification quote.exe
- Size 810KB
- Sample200628-rpljjs46w2
- SHA256 65463a82bb20ec1f2d53e93c9e51538d55fff2844c746afc36e7a1c43cce36e4
- MD5 299c603f94babfbb8c3603dd391cec98
- SHA1 eb9c84751d0e0421ee3ec284a2756885f75c8586
- SHA512 7c5d3ce7efead015fbafa3eb9578ec79eab4d8661f00d82dc4abc19dc98c7d490625de0118ded95fc39bb6d847c9cbb51ab5860023ff856291c9189d136ffe05
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\ADU4ANEPTH = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" explorer.exe - Adds Run entry to policy start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1820 ieinstal.exe 1820 ieinstal.exe 1820 ieinstal.exe 1820 ieinstal.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1820 ieinstal.exe Token: SeDebugPrivilege 1940 explorer.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1820 set thread context of 3044 1820 ieinstal.exe 56 PID 1940 set thread context of 3044 1940 explorer.exe 56 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4004 wrote to memory of 1820 4004 specification quote.exe 68 PID 4004 wrote to memory of 1820 4004 specification quote.exe 68 PID 4004 wrote to memory of 1820 4004 specification quote.exe 68 PID 4004 wrote to memory of 1820 4004 specification quote.exe 68 PID 4004 wrote to memory of 1820 4004 specification quote.exe 68 PID 4004 wrote to memory of 1820 4004 specification quote.exe 68 PID 3044 wrote to memory of 1940 3044 Explorer.EXE 69 PID 3044 wrote to memory of 1940 3044 Explorer.EXE 69 PID 3044 wrote to memory of 1940 3044 Explorer.EXE 69 PID 1940 wrote to memory of 2480 1940 explorer.exe 71 PID 1940 wrote to memory of 2480 1940 explorer.exe 71 PID 1940 wrote to memory of 2480 1940 explorer.exe 71 PID 1940 wrote to memory of 3904 1940 explorer.exe 76 PID 1940 wrote to memory of 3904 1940 explorer.exe 76 PID 1940 wrote to memory of 3904 1940 explorer.exe 76 - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1820 ieinstal.exe 1820 ieinstal.exe 1820 ieinstal.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\specification quote.exe"C:\Users\Admin\AppData\Local\Temp\specification quote.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1820
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Adds Run entry to start application
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1940 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:2480
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3904
-
-