Analysis
- max time kernel
149s - max time network
142s - platform
windows10_x64 - resource
win10v200430 - submitted
28/06/2020, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
Picture3.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Picture3.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Picture3.exe
- Size 962KB
- Sample200628-yphgc2lp4e
- SHA256 03cba0b3813108ec932306f5aaa9d152603a834b9caf3c601722a9cda41ca194
- MD5 126510513ad09e362d53547080fb3586
- SHA1 810a1c7f3559d5e6227022ee37438ea2c382be4d
- SHA512 20637210545fcbdf9f1c1959d98954e448fa6fe98067fe4d1905f0bf83f290226a5c78d36ec470fe8db1e2a56d7f88f3b6f659f58ab6e3ec4f2088ef78618872
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1616 Picture3.exe 1616 Picture3.exe 1616 Picture3.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1616 set thread context of 3024 1616 Picture3.exe 56 PID 2980 set thread context of 3024 2980 cmd.exe 56 - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Adds Run entry to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ikta = "C:\\Users\\Admin\\AppData\\Local\\Ikta\\Ikta.hta" Picture3.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SXL0ARWH1NP = "C:\\Program Files (x86)\\Dwx10d\\3f6iz_.exe" cmd.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Dwx10d\3f6iz_.exe cmd.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1616 Picture3.exe 1616 Picture3.exe 1616 Picture3.exe 1616 Picture3.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe 2980 cmd.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1616 Picture3.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeDebugPrivilege 2980 cmd.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2980 3024 Explorer.EXE 71 PID 3024 wrote to memory of 2980 3024 Explorer.EXE 71 PID 3024 wrote to memory of 2980 3024 Explorer.EXE 71 PID 2980 wrote to memory of 3988 2980 cmd.exe 73 PID 2980 wrote to memory of 3988 2980 cmd.exe 73 PID 2980 wrote to memory of 3988 2980 cmd.exe 73 PID 2980 wrote to memory of 3936 2980 cmd.exe 75 PID 2980 wrote to memory of 3936 2980 cmd.exe 75 PID 2980 wrote to memory of 3936 2980 cmd.exe 75 PID 2980 wrote to memory of 740 2980 cmd.exe 77 PID 2980 wrote to memory of 740 2980 cmd.exe 77 PID 2980 wrote to memory of 740 2980 cmd.exe 77 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\Picture3.exe"C:\Users\Admin\AppData\Local\Temp\Picture3.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Adds Run entry to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Picture3.exe"3⤵PID:3988
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3936
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:740
-
-