Analysis
- max time kernel
146s - max time network
148s - platform
windows10_x64 - resource
win10v200430 - submitted
01/07/2020, 05:31
Static task
static1
Behavioral task
behavioral1
Sample
8c77be101052a6eb0a74ec0e2ba037a9.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8c77be101052a6eb0a74ec0e2ba037a9.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target 8c77be101052a6eb0a74ec0e2ba037a9.exe
- Size 378KB
- Sample200701-chmlcd9vxx
- SHA256 db4aad17cb58975d3c42dc37b92e7c8bfdce82da52c5eb6a5e87709cf906a684
- MD5 8c77be101052a6eb0a74ec0e2ba037a9
- SHA1 15e5042379a1fb98749cebf0a98477a66ae0a77d
- SHA512 d7ed57e7ec842aa4c3f127381a3f21369a5fb852e4f68deaccc3d6a9ff13d612c5a563ee18b0281f909cc1ccb52fe94ab655bbd6b704a5ffc3af611a36cb3cad
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1188 rundll32.exe 1388 cmd.exe 1388 cmd.exe 1388 cmd.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1388 cmd.exe Token: SeDebugPrivilege 2420 msdt.exe Token: SeShutdownPrivilege 3004 Explorer.EXE Token: SeCreatePagefilePrivilege 3004 Explorer.EXE Token: SeShutdownPrivilege 3004 Explorer.EXE Token: SeCreatePagefilePrivilege 3004 Explorer.EXE Token: SeShutdownPrivilege 3004 Explorer.EXE Token: SeCreatePagefilePrivilege 3004 Explorer.EXE Token: SeShutdownPrivilege 3004 Explorer.EXE Token: SeCreatePagefilePrivilege 3004 Explorer.EXE Token: SeShutdownPrivilege 3004 Explorer.EXE Token: SeCreatePagefilePrivilege 3004 Explorer.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1388 set thread context of 3004 1388 cmd.exe 56 PID 2420 set thread context of 3004 2420 msdt.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Obnv\_rphyjg43z28.exe msdt.exe - Suspicious use of WriteProcessMemory 94 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1188 2040 8c77be101052a6eb0a74ec0e2ba037a9.exe 68 PID 2040 wrote to memory of 1188 2040 8c77be101052a6eb0a74ec0e2ba037a9.exe 68 PID 2040 wrote to memory of 1188 2040 8c77be101052a6eb0a74ec0e2ba037a9.exe 68 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 1188 wrote to memory of 1388 1188 rundll32.exe 69 PID 3004 wrote to memory of 2420 3004 Explorer.EXE 74 PID 3004 wrote to memory of 2420 3004 Explorer.EXE 74 PID 3004 wrote to memory of 2420 3004 Explorer.EXE 74 PID 2420 wrote to memory of 2548 2420 msdt.exe 75 PID 2420 wrote to memory of 2548 2420 msdt.exe 75 PID 2420 wrote to memory of 2548 2420 msdt.exe 75 PID 2420 wrote to memory of 3956 2420 msdt.exe 79 PID 2420 wrote to memory of 3956 2420 msdt.exe 79 PID 2420 wrote to memory of 3956 2420 msdt.exe 79 PID 2420 wrote to memory of 3388 2420 msdt.exe 81 PID 2420 wrote to memory of 3388 2420 msdt.exe 81 PID 2420 wrote to memory of 3388 2420 msdt.exe 81 - Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 1188 rundll32.exe 1388 cmd.exe 1388 cmd.exe 1388 cmd.exe 1388 cmd.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe 2420 msdt.exe - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\P0AXEP7PKH = "C:\\Program Files (x86)\\Obnv\\_rphyjg43z28.exe" msdt.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe - Loads dropped DLL 1 IoCs
pid Process 1188 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\8c77be101052a6eb0a74ec0e2ba037a9.exe"C:\Users\Admin\AppData\Local\Temp\8c77be101052a6eb0a74ec0e2ba037a9.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe SkylabDewar,Hemlock3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
PID:1188 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Modifies Internet Explorer settings
PID:2420 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:2548
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3956
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3388
-
-