Analysis
-
max time kernel
145s -
max time network
135s -
platform
windows10_x64 -
resource
win10 -
submitted
09-07-2020 12:13
Static task
static1
Behavioral task
behavioral1
Sample
oOT3aykttE5iZZq.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
oOT3aykttE5iZZq.exe
Resource
win10
General
-
Target
oOT3aykttE5iZZq.exe
-
Size
616KB
-
MD5
2f7ba4389cda2fda6b04c239b26ef587
-
SHA1
83ce7c55e750880c0ef16567bfe017aa28ba3b14
-
SHA256
d76bb689a401094eee47a075368224161d261665c2b285b155d1b7833ba4fbaa
-
SHA512
cc868f319e1f46619ca857c16bd7e9930d2971e2f029a9137d3f1f4dc2a51afbe233dc1ee4bf6a0b32cec321ceb6c9ec02bf3e03ce2ed36e0cc113443c347dcf
Malware Config
Signatures
-
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
oOT3aykttE5iZZq.exeoOT3aykttE5iZZq.execmmon32.exedescription pid process target process PID 3580 set thread context of 3928 3580 oOT3aykttE5iZZq.exe oOT3aykttE5iZZq.exe PID 3928 set thread context of 2976 3928 oOT3aykttE5iZZq.exe Explorer.EXE PID 3928 set thread context of 2976 3928 oOT3aykttE5iZZq.exe Explorer.EXE PID 4000 set thread context of 2976 4000 cmmon32.exe Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
oOT3aykttE5iZZq.execmmon32.exepid process 3928 oOT3aykttE5iZZq.exe 3928 oOT3aykttE5iZZq.exe 3928 oOT3aykttE5iZZq.exe 3928 oOT3aykttE5iZZq.exe 4000 cmmon32.exe 4000 cmmon32.exe -
Drops file in Program Files directory 1 IoCs
Processes:
cmmon32.exedescription ioc process File opened for modification C:\Program Files (x86)\Lppkdul\msobmlqh.exe cmmon32.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
cmmon32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmmon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\PV1LGHTXEL8 = "C:\\Program Files (x86)\\Lppkdul\\msobmlqh.exe" cmmon32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
oOT3aykttE5iZZq.exeExplorer.EXEcmmon32.exedescription pid process target process PID 3580 wrote to memory of 3864 3580 oOT3aykttE5iZZq.exe schtasks.exe PID 3580 wrote to memory of 3864 3580 oOT3aykttE5iZZq.exe schtasks.exe PID 3580 wrote to memory of 3864 3580 oOT3aykttE5iZZq.exe schtasks.exe PID 3580 wrote to memory of 3928 3580 oOT3aykttE5iZZq.exe oOT3aykttE5iZZq.exe PID 3580 wrote to memory of 3928 3580 oOT3aykttE5iZZq.exe oOT3aykttE5iZZq.exe PID 3580 wrote to memory of 3928 3580 oOT3aykttE5iZZq.exe oOT3aykttE5iZZq.exe PID 3580 wrote to memory of 3928 3580 oOT3aykttE5iZZq.exe oOT3aykttE5iZZq.exe PID 3580 wrote to memory of 3928 3580 oOT3aykttE5iZZq.exe oOT3aykttE5iZZq.exe PID 3580 wrote to memory of 3928 3580 oOT3aykttE5iZZq.exe oOT3aykttE5iZZq.exe PID 2976 wrote to memory of 4000 2976 Explorer.EXE cmmon32.exe PID 2976 wrote to memory of 4000 2976 Explorer.EXE cmmon32.exe PID 2976 wrote to memory of 4000 2976 Explorer.EXE cmmon32.exe PID 4000 wrote to memory of 3408 4000 cmmon32.exe cmd.exe PID 4000 wrote to memory of 3408 4000 cmmon32.exe cmd.exe PID 4000 wrote to memory of 3408 4000 cmmon32.exe cmd.exe PID 4000 wrote to memory of 3816 4000 cmmon32.exe cmd.exe PID 4000 wrote to memory of 3816 4000 cmmon32.exe cmd.exe PID 4000 wrote to memory of 3816 4000 cmmon32.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
oOT3aykttE5iZZq.execmmon32.exepid process 3928 oOT3aykttE5iZZq.exe 3928 oOT3aykttE5iZZq.exe 3928 oOT3aykttE5iZZq.exe 3928 oOT3aykttE5iZZq.exe 3928 oOT3aykttE5iZZq.exe 3928 oOT3aykttE5iZZq.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe 4000 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
oOT3aykttE5iZZq.execmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3928 oOT3aykttE5iZZq.exe Token: SeDebugPrivilege 4000 cmmon32.exe Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
cmmon32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cmmon32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\oOT3aykttE5iZZq.exe"C:\Users\Admin\AppData\Local\Temp\oOT3aykttE5iZZq.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnNdfcFfD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7E53.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\oOT3aykttE5iZZq.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\oOT3aykttE5iZZq.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
C:\Users\Admin\AppData\Local\Temp\tmp7E53.tmp
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logim.jpeg
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrg.ini
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logri.ini
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrv.ini
-
memory/2976-9-0x0000000006200000-0x0000000006398000-memory.dmpFilesize
1.6MB
-
memory/3408-7-0x0000000000000000-mapping.dmp
-
memory/3816-11-0x0000000000000000-mapping.dmp
-
memory/3864-0-0x0000000000000000-mapping.dmp
-
memory/3928-2-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3928-3-0x000000000041B6E0-mapping.dmp
-
memory/4000-4-0x0000000000000000-mapping.dmp
-
memory/4000-8-0x0000000005540000-0x000000000565D000-memory.dmpFilesize
1.1MB
-
memory/4000-6-0x0000000000820000-0x000000000082C000-memory.dmpFilesize
48KB
-
memory/4000-5-0x0000000000820000-0x000000000082C000-memory.dmpFilesize
48KB