Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 06:40
Static task
static1
Behavioral task
behavioral1
Sample
PO# 7431.scr
Resource
win7
Behavioral task
behavioral2
Sample
PO# 7431.scr
Resource
win10
General
-
Target
PO# 7431.scr
-
Size
1.9MB
-
MD5
8341d551a5b1665cbb0f65780530b20c
-
SHA1
2fb6aa095ff9406b65f49e94303c925cf8d44fc3
-
SHA256
e65f3e7d58650711f81d06e50e53ced4b636f08df0eed8019d7927e17fec9580
-
SHA512
5c984f07ac00f816a2804fb201ccf956c7ee8645f255a01cbce0d7049bd6658c6d379df53be5c6d4a3775b543304dda6268de5ac717ce9a42cce524bf3545e47
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
PO# 7431.scrInstallUtil.exedescription pid process target process PID 1124 wrote to memory of 1432 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1432 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1432 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1432 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1432 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1432 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1432 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1480 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1480 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1480 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1480 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1480 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1480 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1480 1124 PO# 7431.scr InstallUtil.exe PID 1124 wrote to memory of 1480 1124 PO# 7431.scr InstallUtil.exe PID 1480 wrote to memory of 796 1480 InstallUtil.exe PrivacyOFF.exe PID 1480 wrote to memory of 796 1480 InstallUtil.exe PrivacyOFF.exe PID 1480 wrote to memory of 796 1480 InstallUtil.exe PrivacyOFF.exe PID 1480 wrote to memory of 796 1480 InstallUtil.exe PrivacyOFF.exe PID 1480 wrote to memory of 1120 1480 InstallUtil.exe goon 2.exe PID 1480 wrote to memory of 1120 1480 InstallUtil.exe goon 2.exe PID 1480 wrote to memory of 1120 1480 InstallUtil.exe goon 2.exe PID 1480 wrote to memory of 1120 1480 InstallUtil.exe goon 2.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
PO# 7431.scrpid process 1124 PO# 7431.scr 1124 PO# 7431.scr -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exegoon 2.exepid process 1480 InstallUtil.exe 1120 goon 2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
goon 2.exepid process 1120 goon 2.exe 1120 goon 2.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
PO# 7431.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZESe = "C:\\AVGLFESB\\YZESek\\YZESekoeC.vbs" PO# 7431.scr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO# 7431.scrdescription pid process target process PID 1124 set thread context of 1480 1124 PO# 7431.scr InstallUtil.exe -
Loads dropped DLL 3 IoCs
Processes:
InstallUtil.exepid process 1480 InstallUtil.exe 1480 InstallUtil.exe 1480 InstallUtil.exe -
Executes dropped EXE 2 IoCs
Processes:
PrivacyOFF.exegoon 2.exepid process 796 PrivacyOFF.exe 1120 goon 2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
goon 2.exedescription pid process Token: SeDebugPrivilege 1120 goon 2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO# 7431.scr"C:\Users\Admin\AppData\Local\Temp\PO# 7431.scr" /S1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Adds Run entry to start application
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\InstallUtil.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\PrivacyOFF.exe"C:\Users\Admin\AppData\Local\Temp\PrivacyOFF.exe" 03⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\goon 2.exe"C:\Users\Admin\AppData\Local\Temp\goon 2.exe" 03⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PrivacyOFF.exe
-
C:\Users\Admin\AppData\Local\Temp\PrivacyOFF.exe
-
C:\Users\Admin\AppData\Local\Temp\goon 2.exe
-
C:\Users\Admin\AppData\Local\Temp\goon 2.exe
-
\Users\Admin\AppData\Local\Temp\PrivacyOFF.exe
-
\Users\Admin\AppData\Local\Temp\goon 2.exe
-
\Users\Admin\AppData\Local\Temp\goon 2.exe
-
memory/796-6-0x0000000000000000-mapping.dmp
-
memory/1120-11-0x0000000000000000-mapping.dmp
-
memory/1480-0-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1480-1-0x000000000040104C-mapping.dmp
-
memory/1480-2-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB