Analysis
-
max time kernel
69s -
max time network
73s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 12:10
Static task
static1
Behavioral task
behavioral1
Sample
fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
-
Target
fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe
-
Size
1.1MB
-
MD5
32b2c85efdbb016ad3c04fd3e4ff4cee
-
SHA1
828f0f32aca9eb4d144029919b0dac48ae34de1c
-
SHA256
fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b
-
SHA512
502e9c133d03cc01aa98a348eb46cea69fdd7e2b66ab759d54cc625779a052e89924a805bcf5a3a3954808b460f5297e2e9efb9f84fc675d57dd72ca62edb83b
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3068 wrote to memory of 3864 3068 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe 67 PID 3068 wrote to memory of 3864 3068 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe 67 PID 3068 wrote to memory of 3864 3068 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe 67 PID 3864 wrote to memory of 3600 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe 68 PID 3864 wrote to memory of 3600 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe 68 PID 3600 wrote to memory of 3372 3600 cmd.exe 70 PID 3600 wrote to memory of 3372 3600 cmd.exe 70 -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeImpersonatePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeTcbPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeChangeNotifyPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeCreateTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeBackupPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeRestorePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeIncreaseQuotaPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeAssignPrimaryTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeImpersonatePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeTcbPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeChangeNotifyPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeCreateTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeBackupPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeRestorePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeIncreaseQuotaPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeAssignPrimaryTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeImpersonatePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeTcbPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeChangeNotifyPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeCreateTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeBackupPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeRestorePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeIncreaseQuotaPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeAssignPrimaryTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeImpersonatePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeTcbPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeChangeNotifyPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeCreateTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeBackupPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeRestorePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeIncreaseQuotaPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeAssignPrimaryTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeImpersonatePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeTcbPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeChangeNotifyPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeCreateTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeBackupPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeRestorePrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeIncreaseQuotaPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Token: SeAssignPrimaryTokenPrivilege 3864 fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe -
Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3372 PING.EXE -
Script User-Agent 2 IoCs
description flow ioc HTTP User-Agent header 3 WinHttp.WinHttpRequest.5.1 HTTP User-Agent header 4 WinHttp.WinHttpRequest.5.1 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for installed software on the system 1 TTPs 7 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe"C:\Users\Admin\AppData\Local\Temp\fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exeC:\Users\Admin\AppData\Local\Temp\fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe dfsr2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Checks for installed software on the system
PID:3864 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\Admin\AppData\Local\Temp\fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\system32\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:3372
-
-
-