Analysis
- max time kernel
146s - max time network
148s - platform
windows7_x64 - resource
win7v200430 - submitted
01/07/2020, 05:31
Static task
static1
Behavioral task
behavioral1
Sample
8c77be101052a6eb0a74ec0e2ba037a9.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8c77be101052a6eb0a74ec0e2ba037a9.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target 8c77be101052a6eb0a74ec0e2ba037a9.exe
- Size 378KB
- Sample200701-chmlcd9vxx
- SHA256 db4aad17cb58975d3c42dc37b92e7c8bfdce82da52c5eb6a5e87709cf906a684
- MD5 8c77be101052a6eb0a74ec0e2ba037a9
- SHA1 15e5042379a1fb98749cebf0a98477a66ae0a77d
- SHA512 d7ed57e7ec842aa4c3f127381a3f21369a5fb852e4f68deaccc3d6a9ff13d612c5a563ee18b0281f909cc1ccb52fe94ab655bbd6b704a5ffc3af611a36cb3cad
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 376 wrote to memory of 1624 376 8c77be101052a6eb0a74ec0e2ba037a9.exe 24 PID 376 wrote to memory of 1624 376 8c77be101052a6eb0a74ec0e2ba037a9.exe 24 PID 376 wrote to memory of 1624 376 8c77be101052a6eb0a74ec0e2ba037a9.exe 24 PID 376 wrote to memory of 1624 376 8c77be101052a6eb0a74ec0e2ba037a9.exe 24 PID 376 wrote to memory of 1624 376 8c77be101052a6eb0a74ec0e2ba037a9.exe 24 PID 376 wrote to memory of 1624 376 8c77be101052a6eb0a74ec0e2ba037a9.exe 24 PID 376 wrote to memory of 1624 376 8c77be101052a6eb0a74ec0e2ba037a9.exe 24 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1624 wrote to memory of 1528 1624 rundll32.exe 25 PID 1304 wrote to memory of 1868 1304 Explorer.EXE 28 PID 1304 wrote to memory of 1868 1304 Explorer.EXE 28 PID 1304 wrote to memory of 1868 1304 Explorer.EXE 28 PID 1304 wrote to memory of 1868 1304 Explorer.EXE 28 PID 1868 wrote to memory of 1772 1868 systray.exe 29 PID 1868 wrote to memory of 1772 1868 systray.exe 29 PID 1868 wrote to memory of 1772 1868 systray.exe 29 PID 1868 wrote to memory of 1772 1868 systray.exe 29 PID 1868 wrote to memory of 1320 1868 systray.exe 32 PID 1868 wrote to memory of 1320 1868 systray.exe 32 PID 1868 wrote to memory of 1320 1868 systray.exe 32 PID 1868 wrote to memory of 1320 1868 systray.exe 32 PID 1868 wrote to memory of 1320 1868 systray.exe 32 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1528 cmd.exe Token: SeDebugPrivilege 1868 systray.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1528 set thread context of 1304 1528 cmd.exe 20 PID 1528 set thread context of 1304 1528 cmd.exe 20 PID 1868 set thread context of 1304 1868 systray.exe 20 - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe - Loads dropped DLL 1 IoCs
pid Process 1624 rundll32.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1624 rundll32.exe 1528 cmd.exe 1528 cmd.exe 1528 cmd.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe - Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 1624 rundll32.exe 1528 cmd.exe 1528 cmd.exe 1528 cmd.exe 1528 cmd.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe 1868 systray.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bytktnti\mse2mpefp0.exe systray.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer systray.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\FBCTORWXFBL = "C:\\Program Files (x86)\\Bytktnti\\mse2mpefp0.exe" systray.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\8c77be101052a6eb0a74ec0e2ba037a9.exe"C:\Users\Admin\AppData\Local\Temp\8c77be101052a6eb0a74ec0e2ba037a9.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe SkylabDewar,Hemlock3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1624 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1528
-
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- System policy modification
- Adds Run entry to policy start application
PID:1868 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:1772
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1320
-
-