Analysis
- max time kernel
149s - max time network
114s - platform
windows10_x64 - resource
win10 - submitted
29/06/2020, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254.exe
- Size 6.8MB
- Sample200629-e7dpdyhbax
- SHA256 e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254
- MD5 755c33c9769f874eb5ba88c78f9efae8
- SHA1 2f94b4ce4f9b9c206a5a107c750d95140a592615
- SHA512 cfeec3496c9661f8c3ebda056058e8cfa2b17530e36b8794f979c1d4ac23368b7c48cd927827067ef24a15a58a0091da6c327eac7f45132af013ebee9da6bc9b
- MD5 SHA1 SHA512
Malware Config
Signatures
- Loads dropped DLL 13 IoCs
pid Process 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe 1732 Agof.exe - Checks for installed software on the system 1 TTPs 29 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName MSBuild.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName MSBuild.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName MSBuild.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName MSBuild.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org 8 ip-api.com - Executes dropped EXE 4 IoCs
pid Process 3796 Agof.exe 3780 Lvaooh.exe 1732 Agof.exe 3704 ctfmom.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 35 1732 Agof.exe Token: SeDebugPrivilege 3440 MSBuild.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3780 set thread context of 3440 3780 Lvaooh.exe 72 - Suspicious behavior: EnumeratesProcesses 150 IoCs
pid Process 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
pid Process 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3704 ctfmom.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 384 wrote to memory of 3796 384 e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254.exe 67 PID 384 wrote to memory of 3796 384 e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254.exe 67 PID 384 wrote to memory of 3780 384 e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254.exe 69 PID 384 wrote to memory of 3780 384 e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254.exe 69 PID 384 wrote to memory of 3780 384 e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254.exe 69 PID 3796 wrote to memory of 1732 3796 Agof.exe 70 PID 3796 wrote to memory of 1732 3796 Agof.exe 70 PID 1732 wrote to memory of 3164 1732 Agof.exe 71 PID 1732 wrote to memory of 3164 1732 Agof.exe 71 PID 3780 wrote to memory of 3440 3780 Lvaooh.exe 72 PID 3780 wrote to memory of 3440 3780 Lvaooh.exe 72 PID 3780 wrote to memory of 3440 3780 Lvaooh.exe 72 PID 3780 wrote to memory of 3440 3780 Lvaooh.exe 72 PID 3780 wrote to memory of 3440 3780 Lvaooh.exe 72 PID 3780 wrote to memory of 3440 3780 Lvaooh.exe 72 PID 3780 wrote to memory of 3440 3780 Lvaooh.exe 72 PID 3780 wrote to memory of 3440 3780 Lvaooh.exe 72 PID 3440 wrote to memory of 1976 3440 MSBuild.exe 74 PID 3440 wrote to memory of 1976 3440 MSBuild.exe 74 PID 3440 wrote to memory of 1976 3440 MSBuild.exe 74 PID 1732 wrote to memory of 2104 1732 Agof.exe 76 PID 1732 wrote to memory of 2104 1732 Agof.exe 76 PID 3780 wrote to memory of 3704 3780 Lvaooh.exe 77 PID 3780 wrote to memory of 3704 3780 Lvaooh.exe 77 PID 3780 wrote to memory of 3704 3780 Lvaooh.exe 77 PID 3780 wrote to memory of 3380 3780 Lvaooh.exe 78 PID 3780 wrote to memory of 3380 3780 Lvaooh.exe 78 PID 3780 wrote to memory of 3380 3780 Lvaooh.exe 78 PID 3380 wrote to memory of 3168 3380 cmd.exe 80 PID 3380 wrote to memory of 3168 3380 cmd.exe 80 PID 3380 wrote to memory of 3168 3380 cmd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254.exe"C:\Users\Admin\AppData\Local\Temp\e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\Agof.exe"C:\Users\Admin\AppData\Local\Temp\Agof.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\Agof.exe"C:\Users\Admin\AppData\Local\Temp\Agof.exe"3⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵PID:3164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵PID:2104
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Lvaooh.exe"C:\Users\Admin\AppData\Local\Temp\Lvaooh.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Checks for installed software on the system
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profiles4⤵PID:1976
-
-
-
C:\Users\Admin\AppData\Roaming\ctfmom.exe"C:\Users\Admin\AppData\Roaming\ctfmom.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:3704
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Lvaooh.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵PID:3168
-
-
-