Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
30-06-2020 06:04
Static task
static1
Behavioral task
behavioral1
Sample
X4EbSoE9zyT73W8.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
X4EbSoE9zyT73W8.exe
Resource
win10
General
-
Target
X4EbSoE9zyT73W8.exe
-
Size
303KB
-
MD5
36a98997a49aecb3bdb906085560ad8f
-
SHA1
dfe0df5a15ca5400f2c63e16ede906621778e968
-
SHA256
35b0f0ea8e64564dacb06fb7c9c4816cbe2962e27c72e83b6cca54c92582a620
-
SHA512
fb0bb249a7db74c2cc5ded85054ee93fb4dc1402ceac66486a57b35f413b8341cefed6ce396841d2ac5a33e291c9f1a4e3b47e42457b3496b99ea80a6af50dd8
Malware Config
Signatures
-
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 1 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Program Files (x86)\Gkpx0m\configpbchjl5.exe cmd.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
cmd.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BX4H_RN = "C:\\Program Files (x86)\\Gkpx0m\\configpbchjl5.exe" cmd.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
X4EbSoE9zyT73W8.exeExplorer.EXEcmd.exedescription pid process target process PID 1296 wrote to memory of 1360 1296 X4EbSoE9zyT73W8.exe X4EbSoE9zyT73W8.exe PID 1296 wrote to memory of 1360 1296 X4EbSoE9zyT73W8.exe X4EbSoE9zyT73W8.exe PID 1296 wrote to memory of 1360 1296 X4EbSoE9zyT73W8.exe X4EbSoE9zyT73W8.exe PID 1296 wrote to memory of 1360 1296 X4EbSoE9zyT73W8.exe X4EbSoE9zyT73W8.exe PID 1296 wrote to memory of 1360 1296 X4EbSoE9zyT73W8.exe X4EbSoE9zyT73W8.exe PID 1296 wrote to memory of 1360 1296 X4EbSoE9zyT73W8.exe X4EbSoE9zyT73W8.exe PID 1296 wrote to memory of 1360 1296 X4EbSoE9zyT73W8.exe X4EbSoE9zyT73W8.exe PID 1304 wrote to memory of 1740 1304 Explorer.EXE cmd.exe PID 1304 wrote to memory of 1740 1304 Explorer.EXE cmd.exe PID 1304 wrote to memory of 1740 1304 Explorer.EXE cmd.exe PID 1304 wrote to memory of 1740 1304 Explorer.EXE cmd.exe PID 1740 wrote to memory of 1836 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 1836 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 1836 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 1836 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 1604 1740 cmd.exe Firefox.exe PID 1740 wrote to memory of 1604 1740 cmd.exe Firefox.exe PID 1740 wrote to memory of 1604 1740 cmd.exe Firefox.exe PID 1740 wrote to memory of 1604 1740 cmd.exe Firefox.exe PID 1740 wrote to memory of 1604 1740 cmd.exe Firefox.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
X4EbSoE9zyT73W8.exeX4EbSoE9zyT73W8.execmd.exedescription pid process target process PID 1296 set thread context of 1360 1296 X4EbSoE9zyT73W8.exe X4EbSoE9zyT73W8.exe PID 1360 set thread context of 1304 1360 X4EbSoE9zyT73W8.exe Explorer.EXE PID 1740 set thread context of 1304 1740 cmd.exe Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
X4EbSoE9zyT73W8.execmd.exedescription pid process Token: SeDebugPrivilege 1360 X4EbSoE9zyT73W8.exe Token: SeDebugPrivilege 1740 cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1836 cmd.exe -
Processes:
cmd.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
X4EbSoE9zyT73W8.execmd.exepid process 1360 X4EbSoE9zyT73W8.exe 1360 X4EbSoE9zyT73W8.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
X4EbSoE9zyT73W8.execmd.exepid process 1360 X4EbSoE9zyT73W8.exe 1360 X4EbSoE9zyT73W8.exe 1360 X4EbSoE9zyT73W8.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe 1740 cmd.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\X4EbSoE9zyT73W8.exe"C:\Users\Admin\AppData\Local\Temp\X4EbSoE9zyT73W8.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\X4EbSoE9zyT73W8.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Drops file in Program Files directory
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\X4EbSoE9zyT73W8.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\9381SCQ3\938logim.jpeg
-
C:\Users\Admin\AppData\Roaming\9381SCQ3\938logrf.ini
-
C:\Users\Admin\AppData\Roaming\9381SCQ3\938logri.ini
-
C:\Users\Admin\AppData\Roaming\9381SCQ3\938logrv.ini
-
memory/1296-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1360-2-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1360-3-0x000000000041E2C0-mapping.dmp
-
memory/1604-13-0x0000000000000000-mapping.dmp
-
memory/1604-14-0x000000013F430000-0x000000013F4C3000-memory.dmpFilesize
588KB
-
memory/1740-5-0x0000000049E90000-0x0000000049EDC000-memory.dmpFilesize
304KB
-
memory/1740-11-0x0000000076A10000-0x0000000076B6C000-memory.dmpFilesize
1.4MB
-
memory/1740-12-0x0000000003E80000-0x0000000003FBE000-memory.dmpFilesize
1.2MB
-
memory/1740-10-0x0000000074E20000-0x0000000074F3D000-memory.dmpFilesize
1.1MB
-
memory/1740-9-0x0000000076890000-0x000000007689C000-memory.dmpFilesize
48KB
-
memory/1740-7-0x0000000003030000-0x000000000318E000-memory.dmpFilesize
1.4MB
-
memory/1740-4-0x0000000000000000-mapping.dmp
-
memory/1836-6-0x0000000000000000-mapping.dmp