Analysis
-
max time kernel
73s -
max time network
6s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 12:53
Static task
static1
Behavioral task
behavioral1
Sample
TT SLIP.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
TT SLIP.exe
Resource
win10
General
-
Target
TT SLIP.exe
-
Size
621KB
-
MD5
9be7ccf2784692c34f0a23ee1c6cdf96
-
SHA1
50893829429e45ae306e74499339fb4e71356bf6
-
SHA256
1783a9996138d2b199496d53340e7a68f0f265af553a4caabaaf5fe1ada46e3c
-
SHA512
8be8a31b093a0b5063c861233c92c6b8caac37ccdb7b3198e597cceeb720edd06dd818231d46af0effc987bd0b22048b58abcf2ca95ad3df7708a5d896cc6b7e
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
TT SLIP.exeRegAsm.exepid process 1500 TT SLIP.exe 1020 RegAsm.exe -
Executes dropped EXE 1 IoCs
Processes:
RegAsm.exepid process 1020 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 1020 RegAsm.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Officex = "C:\\Users\\Admin\\AppData\\Roaming\\Officex\\Officex.exe" RegAsm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TT SLIP.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1500 TT SLIP.exe Token: SeDebugPrivilege 1020 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
TT SLIP.exeRegAsm.exepid process 1500 TT SLIP.exe 1500 TT SLIP.exe 1500 TT SLIP.exe 1020 RegAsm.exe 1020 RegAsm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
TT SLIP.exedescription pid process target process PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe PID 1500 wrote to memory of 1020 1500 TT SLIP.exe RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TT SLIP.exedescription pid process target process PID 1500 set thread context of 1020 1500 TT SLIP.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT SLIP.exe"C:\Users\Admin\AppData\Local\Temp\TT SLIP.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"2⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
memory/1020-4-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1020-5-0x0000000000445ACE-mapping.dmp
-
memory/1020-7-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1020-8-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1500-1-0x0000000000000000-0x0000000000000000-disk.dmp