Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 18:09
Static task
static1
Behavioral task
behavioral1
Sample
Order07JUL2020-5-40HQ.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
-
Target
Order07JUL2020-5-40HQ.exe
-
Size
909KB
-
MD5
e003ceeef6a45f3fe2d6b652d77816c8
-
SHA1
96fbeecc72ace768f544b7e574b996171b8d02a0
-
SHA256
8d8236eed9973c50c80b31c7aed1bab0a46dfdcc9b1f1ce749aa7d88963abe1b
-
SHA512
e61fe04a71d50903e78f0b7dcbb8a01ea25b6424c32464e068d5bc38b60d008ce340b26137b15b25e652d108440a78d335367f83f273c8cdd9c6c5d5a55a3a50
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
webmail.tos-thailand.com - Port:
587 - Username:
[email protected] - Password:
P@ssw0rd
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3900 set thread context of 4016 3900 Order07JUL2020-5-40HQ.exe 67 PID 500 set thread context of 3936 500 Windows Update.exe 69 PID 3936 set thread context of 2464 3936 Windows Update.exe 71 PID 3936 set thread context of 776 3936 Windows Update.exe 72 -
Executes dropped EXE 2 IoCs
pid Process 500 Windows Update.exe 3936 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3936 Windows Update.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3900 Order07JUL2020-5-40HQ.exe 3900 Order07JUL2020-5-40HQ.exe 500 Windows Update.exe 500 Windows Update.exe 776 vbc.exe 776 vbc.exe 3936 Windows Update.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3900 wrote to memory of 4016 3900 Order07JUL2020-5-40HQ.exe 67 PID 3900 wrote to memory of 4016 3900 Order07JUL2020-5-40HQ.exe 67 PID 3900 wrote to memory of 4016 3900 Order07JUL2020-5-40HQ.exe 67 PID 4016 wrote to memory of 500 4016 Order07JUL2020-5-40HQ.exe 68 PID 4016 wrote to memory of 500 4016 Order07JUL2020-5-40HQ.exe 68 PID 4016 wrote to memory of 500 4016 Order07JUL2020-5-40HQ.exe 68 PID 500 wrote to memory of 3936 500 Windows Update.exe 69 PID 500 wrote to memory of 3936 500 Windows Update.exe 69 PID 500 wrote to memory of 3936 500 Windows Update.exe 69 PID 3936 wrote to memory of 2464 3936 Windows Update.exe 71 PID 3936 wrote to memory of 2464 3936 Windows Update.exe 71 PID 3936 wrote to memory of 2464 3936 Windows Update.exe 71 PID 3936 wrote to memory of 2464 3936 Windows Update.exe 71 PID 3936 wrote to memory of 2464 3936 Windows Update.exe 71 PID 3936 wrote to memory of 2464 3936 Windows Update.exe 71 PID 3936 wrote to memory of 2464 3936 Windows Update.exe 71 PID 3936 wrote to memory of 2464 3936 Windows Update.exe 71 PID 3936 wrote to memory of 2464 3936 Windows Update.exe 71 PID 3936 wrote to memory of 776 3936 Windows Update.exe 72 PID 3936 wrote to memory of 776 3936 Windows Update.exe 72 PID 3936 wrote to memory of 776 3936 Windows Update.exe 72 PID 3936 wrote to memory of 776 3936 Windows Update.exe 72 PID 3936 wrote to memory of 776 3936 Windows Update.exe 72 PID 3936 wrote to memory of 776 3936 Windows Update.exe 72 PID 3936 wrote to memory of 776 3936 Windows Update.exe 72 PID 3936 wrote to memory of 776 3936 Windows Update.exe 72 PID 3936 wrote to memory of 776 3936 Windows Update.exe 72 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3936 Windows Update.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3900 Order07JUL2020-5-40HQ.exe 500 Windows Update.exe -
Deletes itself 1 IoCs
pid Process 3936 Windows Update.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
resource yara_rule behavioral2/memory/4016-0-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral2/memory/4016-2-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral2/memory/4016-3-0x0000000000400000-0x000000000051D000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyipaddress.com 4 whatismyipaddress.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order07JUL2020-5-40HQ.exe"C:\Users\Admin\AppData\Local\Temp\Order07JUL2020-5-40HQ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\Order07JUL2020-5-40HQ.exe"C:\Users\Admin\AppData\Local\Temp\Order07JUL2020-5-40HQ.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:500 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Deletes itself
PID:3936 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵PID:2464
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
- Suspicious behavior: EnumeratesProcesses
PID:776
-
-
-
-