Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 08:49
Static task
static1
Behavioral task
behavioral1
Sample
7vQQ4HU4QUhXLUo.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
7vQQ4HU4QUhXLUo.exe
Resource
win10
General
-
Target
7vQQ4HU4QUhXLUo.exe
-
Size
431KB
-
MD5
8854b20dd7f9769458e78ae6ebbe156d
-
SHA1
ab2b32ba44e6774af61bf165ac4b8259de8eeb90
-
SHA256
001af3efb9fa637cf4b597d86ec925a4283efb482417861aacabb46a848ec84d
-
SHA512
6b7760101d721185457820a0832d914be0519e6c09710c2c7b71cc98a69ddc252d541cf0c2bced509719681f7398914461027461e9b65c06cf58164e5fd89efc
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
7vQQ4HU4QUhXLUo.exeExplorer.EXEwlanext.exedescription pid process target process PID 676 wrote to memory of 1840 676 7vQQ4HU4QUhXLUo.exe schtasks.exe PID 676 wrote to memory of 1840 676 7vQQ4HU4QUhXLUo.exe schtasks.exe PID 676 wrote to memory of 1840 676 7vQQ4HU4QUhXLUo.exe schtasks.exe PID 676 wrote to memory of 1840 676 7vQQ4HU4QUhXLUo.exe schtasks.exe PID 676 wrote to memory of 1872 676 7vQQ4HU4QUhXLUo.exe 7vQQ4HU4QUhXLUo.exe PID 676 wrote to memory of 1872 676 7vQQ4HU4QUhXLUo.exe 7vQQ4HU4QUhXLUo.exe PID 676 wrote to memory of 1872 676 7vQQ4HU4QUhXLUo.exe 7vQQ4HU4QUhXLUo.exe PID 676 wrote to memory of 1872 676 7vQQ4HU4QUhXLUo.exe 7vQQ4HU4QUhXLUo.exe PID 676 wrote to memory of 1872 676 7vQQ4HU4QUhXLUo.exe 7vQQ4HU4QUhXLUo.exe PID 676 wrote to memory of 1872 676 7vQQ4HU4QUhXLUo.exe 7vQQ4HU4QUhXLUo.exe PID 676 wrote to memory of 1872 676 7vQQ4HU4QUhXLUo.exe 7vQQ4HU4QUhXLUo.exe PID 1184 wrote to memory of 1748 1184 Explorer.EXE wlanext.exe PID 1184 wrote to memory of 1748 1184 Explorer.EXE wlanext.exe PID 1184 wrote to memory of 1748 1184 Explorer.EXE wlanext.exe PID 1184 wrote to memory of 1748 1184 Explorer.EXE wlanext.exe PID 1748 wrote to memory of 516 1748 wlanext.exe cmd.exe PID 1748 wrote to memory of 516 1748 wlanext.exe cmd.exe PID 1748 wrote to memory of 516 1748 wlanext.exe cmd.exe PID 1748 wrote to memory of 516 1748 wlanext.exe cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
7vQQ4HU4QUhXLUo.exe7vQQ4HU4QUhXLUo.exewlanext.exedescription pid process target process PID 676 set thread context of 1872 676 7vQQ4HU4QUhXLUo.exe 7vQQ4HU4QUhXLUo.exe PID 1872 set thread context of 1184 1872 7vQQ4HU4QUhXLUo.exe Explorer.EXE PID 1872 set thread context of 1184 1872 7vQQ4HU4QUhXLUo.exe Explorer.EXE PID 1748 set thread context of 1184 1748 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
7vQQ4HU4QUhXLUo.exewlanext.exepid process 1872 7vQQ4HU4QUhXLUo.exe 1872 7vQQ4HU4QUhXLUo.exe 1872 7vQQ4HU4QUhXLUo.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe 1748 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
7vQQ4HU4QUhXLUo.exewlanext.exepid process 1872 7vQQ4HU4QUhXLUo.exe 1872 7vQQ4HU4QUhXLUo.exe 1872 7vQQ4HU4QUhXLUo.exe 1872 7vQQ4HU4QUhXLUo.exe 1748 wlanext.exe 1748 wlanext.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 516 cmd.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1184 Explorer.EXE 1184 Explorer.EXE 1184 Explorer.EXE 1184 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7vQQ4HU4QUhXLUo.exewlanext.exedescription pid process Token: SeDebugPrivilege 1872 7vQQ4HU4QUhXLUo.exe Token: SeDebugPrivilege 1748 wlanext.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1184 Explorer.EXE 1184 Explorer.EXE 1184 Explorer.EXE 1184 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
wlanext.exedescription ioc process File opened for modification C:\Program Files (x86)\Zltqlrvah\chkdsklfitq6x.exe wlanext.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
wlanext.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wlanext.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MBDXKZIXXX = "C:\\Program Files (x86)\\Zltqlrvah\\chkdsklfitq6x.exe" wlanext.exe -
Processes:
wlanext.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\7vQQ4HU4QUhXLUo.exe"C:\Users\Admin\AppData\Local\Temp\7vQQ4HU4QUhXLUo.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BJtzFOHlPaUN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp49AC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\7vQQ4HU4QUhXLUo.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Adds Run entry to start application
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\7vQQ4HU4QUhXLUo.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp49AC.tmp
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logim.jpeg
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logri.ini
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrv.ini
-
memory/516-7-0x0000000000000000-mapping.dmp
-
memory/1184-4-0x00000000068A0000-0x00000000069FA000-memory.dmpFilesize
1.4MB
-
memory/1748-9-0x0000000075950000-0x0000000075AAC000-memory.dmpFilesize
1.4MB
-
memory/1748-6-0x00000000002D0000-0x00000000002E6000-memory.dmpFilesize
88KB
-
memory/1748-8-0x0000000002F30000-0x0000000002FD8000-memory.dmpFilesize
672KB
-
memory/1748-5-0x0000000000000000-mapping.dmp
-
memory/1840-0-0x0000000000000000-mapping.dmp
-
memory/1872-3-0x000000000041B6E0-mapping.dmp
-
memory/1872-2-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB