Analysis

  • max time kernel
    129s
  • max time network
    117s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    07/07/2020, 18:57

General

  • Target

    ZWSTt.exe

  • Size

    1.1MB

  • MD5

    20e64b93aca0efbe72c29ecb1bf0b83f

  • SHA1

    6d30fd63bfe8df6f57e7de64084bc4dc76be4126

  • SHA256

    1630f3fabf80e99d1990176b5736835496bdbd74610d1e43eefd7088e2529a6e

  • SHA512

    046ace67eee709a9e260ee55d2509e99dca2aac41effc660df0cf3c93a38e09f47aad71f22a3acc2a2defcc06acbc5c266441b263e0c1507803ec0ef08069c5b

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks for installed software on the system 1 TTPs 28 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SendNotifyMessage 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Adds Run entry to start application 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 60021 IoCs