Analysis
-
max time kernel
115s -
max time network
138s -
platform
windows10_x64 -
resource
win10 -
submitted
30-06-2020 06:56
Static task
static1
Behavioral task
behavioral1
Sample
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe
Resource
win7
General
-
Target
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe
-
Size
1.4MB
-
MD5
cb2c94881fae75774b495548bc9e90f7
-
SHA1
8411fd9c37200436f94a0459c0205b43d2c06a6c
-
SHA256
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e
-
SHA512
cc4b2e0d704e78bd14edcec0ff6d76f791a40b4a4e416d5a78cfc0b1948a25ebfe7f15a2d1d520e15e5b87c39c3f6c22ab9a22d7e959f110991a86290b79f1c5
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.execmd.exeMSBuild.exedescription pid process target process PID 3068 wrote to memory of 3864 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 3068 wrote to memory of 3864 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 3068 wrote to memory of 3864 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 3068 wrote to memory of 3864 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 3068 wrote to memory of 3864 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 3068 wrote to memory of 3864 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 3068 wrote to memory of 3864 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 3068 wrote to memory of 3864 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 3068 wrote to memory of 3600 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe cmd.exe PID 3068 wrote to memory of 3600 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe cmd.exe PID 3068 wrote to memory of 3600 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe cmd.exe PID 3600 wrote to memory of 1812 3600 cmd.exe choice.exe PID 3600 wrote to memory of 1812 3600 cmd.exe choice.exe PID 3600 wrote to memory of 1812 3600 cmd.exe choice.exe PID 3864 wrote to memory of 3688 3864 MSBuild.exe netsh.exe PID 3864 wrote to memory of 3688 3864 MSBuild.exe netsh.exe PID 3864 wrote to memory of 3688 3864 MSBuild.exe netsh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3988 3068 WerFault.exe 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org 3 api.ipify.org 7 ip-api.com -
Checks for installed software on the system 1 TTPs 29 IoCs
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName MSBuild.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName MSBuild.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exedescription pid process target process PID 3068 set thread context of 3864 3068 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WerFault.exeMSBuild.exedescription pid process Token: SeRestorePrivilege 3988 WerFault.exe Token: SeBackupPrivilege 3988 WerFault.exe Token: SeDebugPrivilege 3864 MSBuild.exe Token: SeDebugPrivilege 3988 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
WerFault.exeMSBuild.exepid process 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe 3864 MSBuild.exe -
Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe"C:\Users\Admin\AppData\Local\Temp\10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of WriteProcessMemory
- Checks for installed software on the system
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profiles3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 15122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1812-3-0x0000000000000000-mapping.dmp
-
memory/3600-2-0x0000000000000000-mapping.dmp
-
memory/3688-6-0x0000000000000000-mapping.dmp
-
memory/3864-0-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/3864-1-0x0000000000496F8E-mapping.dmp
-
memory/3988-4-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/3988-5-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB