Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 08:01
Static task
static1
Behavioral task
behavioral1
Sample
Purchase advice and details.exe
Resource
win7
Behavioral task
behavioral2
Sample
Purchase advice and details.exe
Resource
win10
General
-
Target
Purchase advice and details.exe
-
Size
663KB
-
MD5
8c49a740ef92731629ce744ca1fece7b
-
SHA1
db2d80f5deba46f40be9357c3576e72aaed73ce5
-
SHA256
aea480ebd5777e840f0b988267554fe1d35f70238bed009231b24475fdc0b0d9
-
SHA512
eb78fcea1a1e5ceb762f620f21cf9e86eac873f1f27a6337e4d41a37396e79bf8bdbe46830e032f899df7d97aeca940d16b70255a4bcfa94430c8b78056c8c35
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
Processes:
cmmon32.exedescription ioc process File opened for modification C:\Program Files (x86)\Cyjlh\chkdsk3fylz.exe cmmon32.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
cmmon32.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cmmon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IZ7DANEXF0 = "C:\\Program Files (x86)\\Cyjlh\\chkdsk3fylz.exe" cmmon32.exe -
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1308 Explorer.EXE 1308 Explorer.EXE 1308 Explorer.EXE 1308 Explorer.EXE 1308 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1420 cmd.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Purchase advice and details.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1116 wrote to memory of 1140 1116 Purchase advice and details.exe Purchase advice and details.exe PID 1116 wrote to memory of 1140 1116 Purchase advice and details.exe Purchase advice and details.exe PID 1116 wrote to memory of 1140 1116 Purchase advice and details.exe Purchase advice and details.exe PID 1116 wrote to memory of 1140 1116 Purchase advice and details.exe Purchase advice and details.exe PID 1308 wrote to memory of 1340 1308 Explorer.EXE cmmon32.exe PID 1308 wrote to memory of 1340 1308 Explorer.EXE cmmon32.exe PID 1308 wrote to memory of 1340 1308 Explorer.EXE cmmon32.exe PID 1308 wrote to memory of 1340 1308 Explorer.EXE cmmon32.exe PID 1340 wrote to memory of 1420 1340 cmmon32.exe cmd.exe PID 1340 wrote to memory of 1420 1340 cmmon32.exe cmd.exe PID 1340 wrote to memory of 1420 1340 cmmon32.exe cmd.exe PID 1340 wrote to memory of 1420 1340 cmmon32.exe cmd.exe PID 1340 wrote to memory of 1524 1340 cmmon32.exe Firefox.exe PID 1340 wrote to memory of 1524 1340 cmmon32.exe Firefox.exe PID 1340 wrote to memory of 1524 1340 cmmon32.exe Firefox.exe PID 1340 wrote to memory of 1524 1340 cmmon32.exe Firefox.exe PID 1340 wrote to memory of 1524 1340 cmmon32.exe Firefox.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
Purchase advice and details.exePurchase advice and details.execmmon32.exepid process 1116 Purchase advice and details.exe 1140 Purchase advice and details.exe 1140 Purchase advice and details.exe 1140 Purchase advice and details.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase advice and details.exePurchase advice and details.execmmon32.exedescription pid process target process PID 1116 set thread context of 1140 1116 Purchase advice and details.exe Purchase advice and details.exe PID 1140 set thread context of 1308 1140 Purchase advice and details.exe Explorer.EXE PID 1340 set thread context of 1308 1340 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
Purchase advice and details.exePurchase advice and details.execmmon32.exepid process 1116 Purchase advice and details.exe 1140 Purchase advice and details.exe 1140 Purchase advice and details.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe 1340 cmmon32.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1308 Explorer.EXE 1308 Explorer.EXE 1308 Explorer.EXE 1308 Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase advice and details.execmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1140 Purchase advice and details.exe Token: SeDebugPrivilege 1340 cmmon32.exe Token: SeShutdownPrivilege 1308 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Purchase advice and details.exe"C:\Users\Admin\AppData\Local\Temp\Purchase advice and details.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Purchase advice and details.exe"C:\Users\Admin\AppData\Local\Temp\Purchase advice and details.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Drops file in Program Files directory
- Adds Run entry to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase advice and details.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologim.jpeg
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologrf.ini
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologri.ini
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologrv.ini
-
memory/1140-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1140-1-0x000000000041E350-mapping.dmp
-
memory/1340-8-0x00000000768C0000-0x0000000076A1C000-memory.dmpFilesize
1.4MB
-
memory/1340-7-0x0000000075070000-0x000000007518D000-memory.dmpFilesize
1.1MB
-
memory/1340-6-0x0000000077410000-0x000000007741C000-memory.dmpFilesize
48KB
-
memory/1340-9-0x0000000003B00000-0x0000000003BE2000-memory.dmpFilesize
904KB
-
memory/1340-5-0x0000000002F10000-0x0000000003015000-memory.dmpFilesize
1.0MB
-
memory/1340-3-0x0000000000370000-0x000000000037D000-memory.dmpFilesize
52KB
-
memory/1340-2-0x0000000000000000-mapping.dmp
-
memory/1420-4-0x0000000000000000-mapping.dmp
-
memory/1524-10-0x0000000000000000-mapping.dmp
-
memory/1524-11-0x000000013FDF0000-0x000000013FE83000-memory.dmpFilesize
588KB