Analysis
- max time kernel
150s - max time network
135s - platform
windows10_x64 - resource
win10 - submitted
08/07/2020, 06:55
Static task
static1
Behavioral task
behavioral1
Sample
5779096d3be228da0d90a9749b5358c9.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5779096d3be228da0d90a9749b5358c9.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 5779096d3be228da0d90a9749b5358c9.exe
- Size 398KB
- Sample200708-mntfj16v4a
- SHA256 2f9ae8ffa46e606acf8b1ffe2e6740dff3da2f2e47411d370ba34b95e9407a08
- MD5 5779096d3be228da0d90a9749b5358c9
- SHA1 3b1058506c51e3b2df3991eb92973b1faf599f59
- SHA512 f635102d7c61db1f88c0760676fd0fb47e19ee0cf73e421dccc1396da4990a08aca7a20855e115e2e45b1e77a93df0a0af5a485276b7d0c059f8998c7fc00280
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious behavior: MapViewOfSection 11 IoCs
pid Process 3848 rundll32.exe 3848 rundll32.exe 3848 rundll32.exe 3848 rundll32.exe 2612 cmd.exe 2612 cmd.exe 2612 cmd.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2612 cmd.exe Token: SeDebugPrivilege 3196 mstsc.exe Token: SeShutdownPrivilege 2980 Explorer.EXE Token: SeCreatePagefilePrivilege 2980 Explorer.EXE Token: SeShutdownPrivilege 2980 Explorer.EXE Token: SeCreatePagefilePrivilege 2980 Explorer.EXE Token: SeShutdownPrivilege 2980 Explorer.EXE Token: SeCreatePagefilePrivilege 2980 Explorer.EXE Token: SeShutdownPrivilege 2980 Explorer.EXE Token: SeCreatePagefilePrivilege 2980 Explorer.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2612 set thread context of 2980 2612 cmd.exe 56 PID 3196 set thread context of 2980 3196 mstsc.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Cgvf8\oxgtrpkzzhp2.exe mstsc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 106 IoCs
description pid Process procid_target PID 3788 wrote to memory of 3848 3788 5779096d3be228da0d90a9749b5358c9.exe 67 PID 3788 wrote to memory of 3848 3788 5779096d3be228da0d90a9749b5358c9.exe 67 PID 3788 wrote to memory of 3848 3788 5779096d3be228da0d90a9749b5358c9.exe 67 PID 3848 wrote to memory of 3860 3848 rundll32.exe 68 PID 3848 wrote to memory of 3860 3848 rundll32.exe 68 PID 3848 wrote to memory of 3860 3848 rundll32.exe 68 PID 3848 wrote to memory of 3860 3848 rundll32.exe 68 PID 3848 wrote to memory of 3268 3848 rundll32.exe 69 PID 3848 wrote to memory of 3268 3848 rundll32.exe 69 PID 3848 wrote to memory of 3268 3848 rundll32.exe 69 PID 3848 wrote to memory of 3268 3848 rundll32.exe 69 PID 3848 wrote to memory of 3844 3848 rundll32.exe 70 PID 3848 wrote to memory of 3844 3848 rundll32.exe 70 PID 3848 wrote to memory of 3844 3848 rundll32.exe 70 PID 3848 wrote to memory of 3844 3848 rundll32.exe 70 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 3848 wrote to memory of 2612 3848 rundll32.exe 71 PID 2980 wrote to memory of 3196 2980 Explorer.EXE 72 PID 2980 wrote to memory of 3196 2980 Explorer.EXE 72 PID 2980 wrote to memory of 3196 2980 Explorer.EXE 72 PID 3196 wrote to memory of 3600 3196 mstsc.exe 73 PID 3196 wrote to memory of 3600 3196 mstsc.exe 73 PID 3196 wrote to memory of 3600 3196 mstsc.exe 73 PID 3196 wrote to memory of 2308 3196 mstsc.exe 81 PID 3196 wrote to memory of 2308 3196 mstsc.exe 81 PID 3196 wrote to memory of 2308 3196 mstsc.exe 81 PID 3196 wrote to memory of 64 3196 mstsc.exe 83 PID 3196 wrote to memory of 64 3196 mstsc.exe 83 PID 3196 wrote to memory of 64 3196 mstsc.exe 83 - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 3848 rundll32.exe 3848 rundll32.exe 3848 rundll32.exe 3848 rundll32.exe 2612 cmd.exe 2612 cmd.exe 2612 cmd.exe 2612 cmd.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe 3196 mstsc.exe - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KHWTEPE80VC8 = "C:\\Program Files (x86)\\Cgvf8\\oxgtrpkzzhp2.exe" mstsc.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe - Loads dropped DLL 2 IoCs
pid Process 3788 5779096d3be228da0d90a9749b5358c9.exe 3848 rundll32.exe - js 2 IoCs
resource yara_rule behavioral2/memory/3196-7-0x0000000000940000-0x0000000000C3C000-memory.dmp js behavioral2/memory/3196-8-0x0000000000940000-0x0000000000C3C000-memory.dmp js
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\5779096d3be228da0d90a9749b5358c9.exe"C:\Users\Admin\AppData\Local\Temp\5779096d3be228da0d90a9749b5358c9.exe"2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:3788 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe WootzRodeo,Epimers3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
PID:3848 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:3860
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:3268
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:3844
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2612
-
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Modifies Internet Explorer settings
PID:3196 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:3600
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:2308
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:64
-
-