Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7v200430 - submitted
07/07/2020, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
vv.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vv.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target vv.exe
- Size 775KB
- Sample200707-vf2rm48l3e
- SHA256 2edc612812919760be42de00fde052d6808281cd5009fb6050b21b67cc6db93f
- MD5 7507fa9b94527509a21acb9bfe828508
- SHA1 05caf17950016f78f93551a87456582778991a07
- SHA512 44569de61755f46c4d3e6b190ab7c2ab426996dd36bb491b53a1b79f92a6f4cc287f2ca9ba790104b641f16770aea3130f6ea5a46cb03c0a23dbf35c83b79b35
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1056 vv.exe 1064 vv.exe 1064 vv.exe 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1064 vv.exe Token: SeDebugPrivilege 1664 NETSTAT.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1064 set thread context of 1324 1064 vv.exe 20 PID 1664 set thread context of 1324 1664 NETSTAT.EXE 20 - Deletes itself 1 IoCs
pid Process 1212 cmd.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Tqdfpl0t\winjvqlw0.exe NETSTAT.EXE - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run NETSTAT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4H-X6TPHEL = "C:\\Program Files (x86)\\Tqdfpl0t\\winjvqlw0.exe" NETSTAT.EXE - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1056 wrote to memory of 1064 1056 vv.exe 26 PID 1056 wrote to memory of 1064 1056 vv.exe 26 PID 1056 wrote to memory of 1064 1056 vv.exe 26 PID 1056 wrote to memory of 1064 1056 vv.exe 26 PID 1056 wrote to memory of 1064 1056 vv.exe 26 PID 1056 wrote to memory of 1064 1056 vv.exe 26 PID 1056 wrote to memory of 1064 1056 vv.exe 26 PID 1056 wrote to memory of 1064 1056 vv.exe 26 PID 1056 wrote to memory of 1064 1056 vv.exe 26 PID 1324 wrote to memory of 1664 1324 Explorer.EXE 28 PID 1324 wrote to memory of 1664 1324 Explorer.EXE 28 PID 1324 wrote to memory of 1664 1324 Explorer.EXE 28 PID 1324 wrote to memory of 1664 1324 Explorer.EXE 28 PID 1664 wrote to memory of 1212 1664 NETSTAT.EXE 29 PID 1664 wrote to memory of 1212 1664 NETSTAT.EXE 29 PID 1664 wrote to memory of 1212 1664 NETSTAT.EXE 29 PID 1664 wrote to memory of 1212 1664 NETSTAT.EXE 29 PID 1664 wrote to memory of 1280 1664 NETSTAT.EXE 32 PID 1664 wrote to memory of 1280 1664 NETSTAT.EXE 32 PID 1664 wrote to memory of 1280 1664 NETSTAT.EXE 32 PID 1664 wrote to memory of 1280 1664 NETSTAT.EXE 32 PID 1664 wrote to memory of 1280 1664 NETSTAT.EXE 32 - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1064 vv.exe 1064 vv.exe 1064 vv.exe 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE 1664 NETSTAT.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\vv.exe"C:\Users\Admin\AppData\Local\Temp\vv.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\vv.exe"C:\Users\Admin\AppData\Local\Temp\vv.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1064
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1476
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
PID:1664 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vv.exe"3⤵
- Deletes itself
PID:1212
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1280
-
-