Analysis
- max time kernel
134s - max time network
144s - platform
windows10_x64 - resource
win10 - submitted
06/07/2020, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe
- Size 6.7MB
- Sample200706-ewjf3j7112
- SHA256 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68
- MD5 d92d0c07b094bc5594622ffe13479eb3
- SHA1 1e32968c5b57f5d0085148f87521cec804b629eb
- SHA512 c90d919d5be51cc865771ce9e526a66eb8cadf19802ec40f0bf19ef8a168b7c4e5eb7851b522789f67d23ece3ad2755bff4c044fbc059da10774d16b76643915
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2600 wrote to memory of 3964 2600 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe 68 PID 2600 wrote to memory of 3964 2600 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe 68 PID 2600 wrote to memory of 3964 2600 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe 68 PID 2600 wrote to memory of 3964 2600 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe 68 PID 2600 wrote to memory of 3964 2600 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe 68 PID 2600 wrote to memory of 3964 2600 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe 68 PID 2600 wrote to memory of 3964 2600 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe 68 PID 2600 wrote to memory of 3964 2600 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe 68 PID 3964 wrote to memory of 3300 3964 MSBuild.exe 69 PID 3964 wrote to memory of 3300 3964 MSBuild.exe 69 PID 3964 wrote to memory of 3300 3964 MSBuild.exe 69 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2600 set thread context of 3964 2600 5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe 68 - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3964 MSBuild.exe 3964 MSBuild.exe 3964 MSBuild.exe 3964 MSBuild.exe 3964 MSBuild.exe 3964 MSBuild.exe 3964 MSBuild.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe 1540 WerFault.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1540 3964 WerFault.exe 68 - Checks for installed software on the system 1 TTPs 29 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName MSBuild.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName MSBuild.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName MSBuild.exe - Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3964 MSBuild.exe Token: SeRestorePrivilege 1540 WerFault.exe Token: SeBackupPrivilege 1540 WerFault.exe Token: SeDebugPrivilege 1540 WerFault.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe"C:\Users\Admin\AppData\Local\Temp\5073dae4db5d373083392acc876b2cee4a9c0a06001be580dd5fbca8f6124f68.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Checks for installed software on the system
- Suspicious use of AdjustPrivilegeToken
PID:3964 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profiles3⤵PID:3300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 24603⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-