Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 05:32
Static task
static1
Behavioral task
behavioral1
Sample
a48efe002e755fc23f7275abd4ce400b.exe
Resource
win7
Behavioral task
behavioral2
Sample
a48efe002e755fc23f7275abd4ce400b.exe
Resource
win10v200430
General
-
Target
a48efe002e755fc23f7275abd4ce400b.exe
-
Size
303KB
-
MD5
a48efe002e755fc23f7275abd4ce400b
-
SHA1
7cb214b2dc8b861e6ee26ac120e494d43035813b
-
SHA256
bf9fd5adc66ebd40de81eda76543a9b798ad480aab0d0316e7d13a6d51525816
-
SHA512
7b8bea89127a5584792e90de20fa8b72867065a3394c4f8065a312e9b273611a3d362c420ea1ea3210d523131e740bcdf7de7a847afba60d6dc98f58e70e178a
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
cmd.exenetsh.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 552 cmd.exe Token: SeDebugPrivilege 2208 netsh.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
netsh.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run netsh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YD8LEPXHQZC = "C:\\Program Files (x86)\\Rxprtq\\hlsohehb.exe" netsh.exe -
Processes:
netsh.exedescription ioc process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 1 IoCs
Processes:
netsh.exedescription ioc process File opened for modification C:\Program Files (x86)\Rxprtq\hlsohehb.exe netsh.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 412 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
rundll32.execmd.exenetsh.exepid process 412 rundll32.exe 552 cmd.exe 552 cmd.exe 552 cmd.exe 2208 netsh.exe 2208 netsh.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cmd.exenetsh.exedescription pid process target process PID 552 set thread context of 2996 552 cmd.exe Explorer.EXE PID 2208 set thread context of 2996 2208 netsh.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
netsh.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer netsh.exe -
Suspicious use of WriteProcessMemory 91 IoCs
Processes:
a48efe002e755fc23f7275abd4ce400b.exerundll32.exedescription pid process target process PID 3848 wrote to memory of 412 3848 a48efe002e755fc23f7275abd4ce400b.exe rundll32.exe PID 3848 wrote to memory of 412 3848 a48efe002e755fc23f7275abd4ce400b.exe rundll32.exe PID 3848 wrote to memory of 412 3848 a48efe002e755fc23f7275abd4ce400b.exe rundll32.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe PID 412 wrote to memory of 552 412 rundll32.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
rundll32.execmd.exenetsh.exepid process 412 rundll32.exe 552 cmd.exe 552 cmd.exe 552 cmd.exe 552 cmd.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe 2208 netsh.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a48efe002e755fc23f7275abd4ce400b.exe"C:\Users\Admin\AppData\Local\Temp\a48efe002e755fc23f7275abd4ce400b.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Fireside,Pretor3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- System policy modification
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
C:\Users\Admin\AppData\Local\Temp\Fireside.DLL
-
C:\Users\Admin\AppData\Local\Temp\Mantel
-
\Users\Admin\AppData\Local\Temp\Fireside.dll
-
memory/412-0-0x0000000000000000-mapping.dmp
-
memory/552-4-0x0000000000000000-mapping.dmp
-
memory/2012-10-0x0000000000000000-mapping.dmp
-
memory/2208-5-0x0000000000000000-mapping.dmp
-
memory/2208-6-0x0000000001590000-0x00000000015AE000-memory.dmpFilesize
120KB
-
memory/2208-7-0x0000000001590000-0x00000000015AE000-memory.dmpFilesize
120KB
-
memory/2604-8-0x0000000000000000-mapping.dmp