c7d0667415a777e1c2ec3812912ff0e33a103c7a873b2f1cf637547bf8027cfd

General

Target

d7586ef8070b30908091c3ad10508249.exe
Size

849KB
MD5

d7586ef8070b30908091c3ad10508249
SHA1

38120210736c1fb5bbb16804894877f5df77268f
SHA256

c7d0667415a777e1c2ec3812912ff0e33a103c7a873b2f1cf637547bf8027cfd
SHA512

93c55b02ad116d778e86749de478ffed42c0558e31784f1c96922b57232b6d4970191d4a84b99f0cbcf91a1fdf8929c3987dcd69bd6a8be4e5cf0356750385d8

Score

7^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1500 wrote to memory of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1500 wrote to memory of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1500 wrote to memory of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1500 wrote to memory of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1500 wrote to memory of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1500 wrote to memory of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1500 wrote to memory of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1500 wrote to memory of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1316 wrote to memory of 1820	1316	Explorer.EXE	27
PID 1316 wrote to memory of 1820	1316	Explorer.EXE	27
PID 1316 wrote to memory of 1820	1316	Explorer.EXE	27
PID 1316 wrote to memory of 1820	1316	Explorer.EXE	27
PID 1820 wrote to memory of 1596	1820	NETSTAT.EXE	30
PID 1820 wrote to memory of 1596	1820	NETSTAT.EXE	30
PID 1820 wrote to memory of 1596	1820	NETSTAT.EXE	30
PID 1820 wrote to memory of 1596	1820	NETSTAT.EXE	30
PID 1820 wrote to memory of 1596	1820	NETSTAT.EXE	30

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 1216	1500	d7586ef8070b30908091c3ad10508249.exe	26
PID 1216 set thread context of 1316	1216	ieinstal.exe	20
PID 1820 set thread context of 1316	1820	NETSTAT.EXE	20

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1216	ieinstal.exe
1216	ieinstal.exe
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1316	Explorer.EXE
1316	Explorer.EXE
1316	Explorer.EXE
1316	Explorer.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Wqzu = "C:\\Users\\Admin\\AppData\\Local\\Wqzu\\Wqzu.hta"	d7586ef8070b30908091c3ad10508249.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	NETSTAT.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	ieinstal.exe
Token: SeDebugPrivilege	1820	NETSTAT.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1216	ieinstal.exe
1216	ieinstal.exe
1216	ieinstal.exe
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE
1820	NETSTAT.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1316	Explorer.EXE
1316	Explorer.EXE
1316	Explorer.EXE
1316	Explorer.EXE
1316	Explorer.EXE

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
PID:1316
- C:\Users\Admin\AppData\Local\Temp\d7586ef8070b30908091c3ad10508249.exe
  "C:\Users\Admin\AppData\Local\Temp\d7586ef8070b30908091c3ad10508249.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Adds Run entry to start application
  PID:1500
- - C:\Program Files (x86)\internet explorer\ieinstal.exe
    "C:\Program Files (x86)\internet explorer\ieinstal.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: MapViewOfSection
    PID:1216
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\SysWOW64\NETSTAT.EXE"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: MapViewOfSection
  PID:1820
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1596-7-0x000000013FA00000-0x000000013FA93000-memory.dmp

Filesize
588KB

Download
memory/1820-3-0x0000000000040000-0x0000000000049000-memory.dmp

Filesize
36KB

Download
memory/1820-4-0x00000000030E0000-0x000000000324E000-memory.dmp

Filesize
1.4MB

Download
memory/1820-5-0x0000000003B10000-0x0000000003C96000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads