Analysis
- max time kernel
149s - max time network
131s - platform
windows10_x64 - resource
win10 - submitted
03/07/2020, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
0zraDXiYQMs3XWK.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0zraDXiYQMs3XWK.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 0zraDXiYQMs3XWK.exe
- Size 423KB
- Sample200703-e8z2w23sa2
- SHA256 3490dfb2560aed5d468605fbba8d770eeee2a336de3fd7e4a18f22afcad5bc44
- MD5 cf54f5dac9665d74175ffea91e353789
- SHA1 7d3e2706933adc26d630b48ad7bceaf035a3fe06
- SHA512 a0a2be7c3848f660837125370b5616ee61e03c6e16f5251b3326072bdcafe8a90ed760c19b5bea3581a376851bffe15bb9fb28c518e409c50887f931102de466
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cmmon32.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmmon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\E0XLEFZ0EHE = "C:\\Program Files (x86)\\Yohlp7bmx\\ghodos0h.exe" cmmon32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3860 schtasks.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3928 0zraDXiYQMs3XWK.exe 3928 0zraDXiYQMs3XWK.exe 3928 0zraDXiYQMs3XWK.exe 3928 0zraDXiYQMs3XWK.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3928 0zraDXiYQMs3XWK.exe Token: SeDebugPrivilege 4000 cmmon32.exe Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Yohlp7bmx\ghodos0h.exe cmmon32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3888 wrote to memory of 3860 3888 0zraDXiYQMs3XWK.exe 67 PID 3888 wrote to memory of 3860 3888 0zraDXiYQMs3XWK.exe 67 PID 3888 wrote to memory of 3860 3888 0zraDXiYQMs3XWK.exe 67 PID 3888 wrote to memory of 3928 3888 0zraDXiYQMs3XWK.exe 69 PID 3888 wrote to memory of 3928 3888 0zraDXiYQMs3XWK.exe 69 PID 3888 wrote to memory of 3928 3888 0zraDXiYQMs3XWK.exe 69 PID 3888 wrote to memory of 3928 3888 0zraDXiYQMs3XWK.exe 69 PID 3888 wrote to memory of 3928 3888 0zraDXiYQMs3XWK.exe 69 PID 3888 wrote to memory of 3928 3888 0zraDXiYQMs3XWK.exe 69 PID 2976 wrote to memory of 4000 2976 Explorer.EXE 70 PID 2976 wrote to memory of 4000 2976 Explorer.EXE 70 PID 2976 wrote to memory of 4000 2976 Explorer.EXE 70 PID 4000 wrote to memory of 3408 4000 cmmon32.exe 71 PID 4000 wrote to memory of 3408 4000 cmmon32.exe 71 PID 4000 wrote to memory of 3408 4000 cmmon32.exe 71 PID 4000 wrote to memory of 1244 4000 cmmon32.exe 79 PID 4000 wrote to memory of 1244 4000 cmmon32.exe 79 PID 4000 wrote to memory of 1244 4000 cmmon32.exe 79 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3888 set thread context of 3928 3888 0zraDXiYQMs3XWK.exe 69 PID 3928 set thread context of 2976 3928 0zraDXiYQMs3XWK.exe 56 PID 4000 set thread context of 2976 4000 cmmon32.exe 56 - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3928 0zraDXiYQMs3XWK.exe 3928 0zraDXiYQMs3XWK.exe 3928 0zraDXiYQMs3XWK.exe 4000 cmmon32.exe 4000 cmmon32.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\0zraDXiYQMs3XWK.exe"C:\Users\Admin\AppData\Local\Temp\0zraDXiYQMs3XWK.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3888 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nmvlgPGKLOouDy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7A99.tmp"3⤵
- Creates scheduled task(s)
PID:3860
-
-
C:\Users\Admin\AppData\Local\Temp\0zraDXiYQMs3XWK.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3928
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- System policy modification
- Adds Run entry to policy start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
PID:4000 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\0zraDXiYQMs3XWK.exe"3⤵PID:3408
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1244
-
-