Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7 -
submitted
08/07/2020, 06:55
Static task
static1
Behavioral task
behavioral1
Sample
5779096d3be228da0d90a9749b5358c9.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5779096d3be228da0d90a9749b5358c9.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
5779096d3be228da0d90a9749b5358c9.exe
-
Size
398KB
-
MD5
5779096d3be228da0d90a9749b5358c9
-
SHA1
3b1058506c51e3b2df3991eb92973b1faf599f59
-
SHA256
2f9ae8ffa46e606acf8b1ffe2e6740dff3da2f2e47411d370ba34b95e9407a08
-
SHA512
f635102d7c61db1f88c0760676fd0fb47e19ee0cf73e421dccc1396da4990a08aca7a20855e115e2e45b1e77a93df0a0af5a485276b7d0c059f8998c7fc00280
Score
8/10
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1308 1060 5779096d3be228da0d90a9749b5358c9.exe 24 PID 1060 wrote to memory of 1308 1060 5779096d3be228da0d90a9749b5358c9.exe 24 PID 1060 wrote to memory of 1308 1060 5779096d3be228da0d90a9749b5358c9.exe 24 PID 1060 wrote to memory of 1308 1060 5779096d3be228da0d90a9749b5358c9.exe 24 PID 1060 wrote to memory of 1308 1060 5779096d3be228da0d90a9749b5358c9.exe 24 PID 1060 wrote to memory of 1308 1060 5779096d3be228da0d90a9749b5358c9.exe 24 PID 1060 wrote to memory of 1308 1060 5779096d3be228da0d90a9749b5358c9.exe 24 PID 1308 wrote to memory of 1312 1308 rundll32.exe 25 PID 1308 wrote to memory of 1312 1308 rundll32.exe 25 PID 1308 wrote to memory of 1312 1308 rundll32.exe 25 PID 1308 wrote to memory of 1312 1308 rundll32.exe 25 PID 1308 wrote to memory of 1312 1308 rundll32.exe 25 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1308 wrote to memory of 1432 1308 rundll32.exe 26 PID 1324 wrote to memory of 1520 1324 Explorer.EXE 27 PID 1324 wrote to memory of 1520 1324 Explorer.EXE 27 PID 1324 wrote to memory of 1520 1324 Explorer.EXE 27 PID 1324 wrote to memory of 1520 1324 Explorer.EXE 27 PID 1520 wrote to memory of 296 1520 msdt.exe 28 PID 1520 wrote to memory of 296 1520 msdt.exe 28 PID 1520 wrote to memory of 296 1520 msdt.exe 28 PID 1520 wrote to memory of 296 1520 msdt.exe 28 PID 1520 wrote to memory of 1884 1520 msdt.exe 33 PID 1520 wrote to memory of 1884 1520 msdt.exe 33 PID 1520 wrote to memory of 1884 1520 msdt.exe 33 PID 1520 wrote to memory of 1884 1520 msdt.exe 33 -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1308 rundll32.exe 1308 rundll32.exe 1432 cmd.exe 1432 cmd.exe 1432 cmd.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1432 set thread context of 1324 1432 cmd.exe 20 PID 1520 set thread context of 1324 1520 msdt.exe 20 -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1308 rundll32.exe 1308 rundll32.exe 1432 cmd.exe 1432 cmd.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe 1520 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1432 cmd.exe Token: SeDebugPrivilege 1520 msdt.exe Token: SeShutdownPrivilege 1324 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bztqlgh18\colorcplmpttjhuh.exe msdt.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer msdt.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\J0HDI47HUBA = "C:\\Program Files (x86)\\Bztqlgh18\\colorcplmpttjhuh.exe" msdt.exe -
Loads dropped DLL 2 IoCs
pid Process 1060 5779096d3be228da0d90a9749b5358c9.exe 1308 rundll32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\5779096d3be228da0d90a9749b5358c9.exe"C:\Users\Admin\AppData\Local\Temp\5779096d3be228da0d90a9749b5358c9.exe"2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1060 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe WootzRodeo,Epimers3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
PID:1308 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1312
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- System policy modification
- Adds Run entry to policy start application
PID:1520 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:296
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1884
-
-