03cba0b3813108ec932306f5aaa9d152603a834b9caf3c601722a9cda41ca194

General

Target
Picture3.exe
Size 962KB
Sample200628-yphgc2lp4e
SHA256 03cba0b3813108ec932306f5aaa9d152603a834b9caf3c601722a9cda41ca194
MD5 126510513ad09e362d53547080fb3586
SHA1 810a1c7f3559d5e6227022ee37438ea2c382be4d
SHA512 20637210545fcbdf9f1c1959d98954e448fa6fe98067fe4d1905f0bf83f290226a5c78d36ec470fe8db1e2a56d7f88f3b6f659f58ab6e3ec4f2088ef78618872
MD5 SHA1 SHA512

Score

8^/10

persistence spyware evasion trojan

Malware Config

Signatures

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NAPSTAT.EXE

Adds Run entry to policy start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	NAPSTAT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1B3DUFW8NHJH = "C:\\Program Files (x86)\\Ce0hpct\\audiodgzv18dx90.exe"	NAPSTAT.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	Picture3.exe
Token: SeDebugPrivilege	1536	NAPSTAT.EXE
Token: SeShutdownPrivilege	1304	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1124	Picture3.exe
1124	Picture3.exe
1124	Picture3.exe
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 1304	1124	Picture3.exe	20
PID 1536 set thread context of 1304	1536	NAPSTAT.EXE	20

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE
1304	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1536	1304	Explorer.EXE	26
PID 1304 wrote to memory of 1536	1304	Explorer.EXE	26
PID 1304 wrote to memory of 1536	1304	Explorer.EXE	26
PID 1304 wrote to memory of 1536	1304	Explorer.EXE	26
PID 1536 wrote to memory of 1796	1536	NAPSTAT.EXE	27
PID 1536 wrote to memory of 1796	1536	NAPSTAT.EXE	27
PID 1536 wrote to memory of 1796	1536	NAPSTAT.EXE	27
PID 1536 wrote to memory of 1796	1536	NAPSTAT.EXE	27
PID 1536 wrote to memory of 1768	1536	NAPSTAT.EXE	29
PID 1536 wrote to memory of 1768	1536	NAPSTAT.EXE	29
PID 1536 wrote to memory of 1768	1536	NAPSTAT.EXE	29
PID 1536 wrote to memory of 1768	1536	NAPSTAT.EXE	29
PID 1536 wrote to memory of 1768	1536	NAPSTAT.EXE	29

Deletes itself 1 IoCs

pid	Process
1796	cmd.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ikta = "C:\\Users\\Admin\\AppData\\Local\\Ikta\\Ikta.hta"	Picture3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ce0hpct\audiodgzv18dx90.exe	NAPSTAT.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	NAPSTAT.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1124	Picture3.exe
1124	Picture3.exe
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE
1536	NAPSTAT.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Checks whether UAC is enabled
PID:1304
- C:\Users\Admin\AppData\Local\Temp\Picture3.exe
  "C:\Users\Admin\AppData\Local\Temp\Picture3.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetThreadContext
  - Adds Run entry to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Windows\SysWOW64\NAPSTAT.EXE
  "C:\Windows\SysWOW64\NAPSTAT.EXE"
  2⤵
  - System policy modification
  - Adds Run entry to policy start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Picture3.exe"
    3⤵
    - Deletes itself
    PID:1796
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1768