Analysis
- max time kernel
128s - max time network
43s - platform
windows10_x64 - resource
win10v200430 - submitted
29/06/2020, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
fok.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target fok.exe
- Size 561KB
- Sample200629-sc4lkepfda
- SHA256 82c531ee47fd52c78ed90b259be7908208ae6657a75643fce70df85eb0cd64a3
- MD5 bc045a8724b69691d011edbfbfd12333
- SHA1 f3bf08df7afff9e99a8c1513b53aa168d5553003
- SHA512 b69b5ee83333faa5835f2a2b73a3381b41dd5a2d4c92ca3f26ceedb345b0314e11ed15d08ee16dbeccc8a331c34065d76485a6ea0c08ecbab1c610f5d101598d
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1484 set thread context of 1600 1484 fok.exe 68 - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeImpersonatePrivilege 1600 fok.exe Token: SeTcbPrivilege 1600 fok.exe Token: SeChangeNotifyPrivilege 1600 fok.exe Token: SeCreateTokenPrivilege 1600 fok.exe Token: SeBackupPrivilege 1600 fok.exe Token: SeRestorePrivilege 1600 fok.exe Token: SeIncreaseQuotaPrivilege 1600 fok.exe Token: SeAssignPrimaryTokenPrivilege 1600 fok.exe Token: SeImpersonatePrivilege 1600 fok.exe Token: SeTcbPrivilege 1600 fok.exe Token: SeChangeNotifyPrivilege 1600 fok.exe Token: SeCreateTokenPrivilege 1600 fok.exe Token: SeBackupPrivilege 1600 fok.exe Token: SeRestorePrivilege 1600 fok.exe Token: SeIncreaseQuotaPrivilege 1600 fok.exe Token: SeAssignPrimaryTokenPrivilege 1600 fok.exe Token: SeImpersonatePrivilege 1600 fok.exe Token: SeTcbPrivilege 1600 fok.exe Token: SeChangeNotifyPrivilege 1600 fok.exe Token: SeCreateTokenPrivilege 1600 fok.exe Token: SeBackupPrivilege 1600 fok.exe Token: SeRestorePrivilege 1600 fok.exe Token: SeIncreaseQuotaPrivilege 1600 fok.exe Token: SeAssignPrimaryTokenPrivilege 1600 fok.exe Token: SeImpersonatePrivilege 1600 fok.exe Token: SeTcbPrivilege 1600 fok.exe Token: SeChangeNotifyPrivilege 1600 fok.exe Token: SeCreateTokenPrivilege 1600 fok.exe Token: SeBackupPrivilege 1600 fok.exe Token: SeRestorePrivilege 1600 fok.exe Token: SeIncreaseQuotaPrivilege 1600 fok.exe Token: SeAssignPrimaryTokenPrivilege 1600 fok.exe Token: SeImpersonatePrivilege 1600 fok.exe Token: SeTcbPrivilege 1600 fok.exe Token: SeChangeNotifyPrivilege 1600 fok.exe Token: SeCreateTokenPrivilege 1600 fok.exe Token: SeBackupPrivilege 1600 fok.exe Token: SeRestorePrivilege 1600 fok.exe Token: SeIncreaseQuotaPrivilege 1600 fok.exe Token: SeAssignPrimaryTokenPrivilege 1600 fok.exe - Checks for installed software on the system 1 TTPs 7 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName fok.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName fok.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName fok.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall fok.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall fok.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName fok.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName fok.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1484 fok.exe 1484 fok.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1600 1484 fok.exe 68 PID 1484 wrote to memory of 1600 1484 fok.exe 68 PID 1484 wrote to memory of 1600 1484 fok.exe 68 PID 1600 wrote to memory of 2452 1600 fok.exe 69 PID 1600 wrote to memory of 2452 1600 fok.exe 69 PID 1600 wrote to memory of 2452 1600 fok.exe 69 - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1484 fok.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fok.exe"C:\Users\Admin\AppData\Local\Temp\fok.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\fok.exe"C:\Users\Admin\AppData\Local\Temp\fok.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\130234.bat" "C:\Users\Admin\AppData\Local\Temp\fok.exe" "3⤵PID:2452
-
-