Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10 -
submitted
09/07/2020, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
6dd7773f1243d53e392e0d6c8f2c9b6d.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6dd7773f1243d53e392e0d6c8f2c9b6d.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
6dd7773f1243d53e392e0d6c8f2c9b6d.exe
-
Size
546KB
-
MD5
6dd7773f1243d53e392e0d6c8f2c9b6d
-
SHA1
20623a673280a1170bf2c06de4395e598db0b3eb
-
SHA256
51b2fe7ed5d6da110fe512ac143f26b29b8819b25f4540e93825d310d60d2511
-
SHA512
7767efa2ab0c0729dad5c140a1b87fc2b38b5e1b335f120b68828bd6fb6e775f7df3702788c25a2941c855e9fa493e7927206df44d7eb179b81a91751900cfde
Score
7/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3404 wrote to memory of 3432 3404 6dd7773f1243d53e392e0d6c8f2c9b6d.exe 67 PID 3404 wrote to memory of 3432 3404 6dd7773f1243d53e392e0d6c8f2c9b6d.exe 67 PID 3404 wrote to memory of 3432 3404 6dd7773f1243d53e392e0d6c8f2c9b6d.exe 67 PID 3404 wrote to memory of 3432 3404 6dd7773f1243d53e392e0d6c8f2c9b6d.exe 67 PID 3404 wrote to memory of 3432 3404 6dd7773f1243d53e392e0d6c8f2c9b6d.exe 67 PID 3008 wrote to memory of 3428 3008 Explorer.EXE 68 PID 3008 wrote to memory of 3428 3008 Explorer.EXE 68 PID 3008 wrote to memory of 3428 3008 Explorer.EXE 68 PID 3428 wrote to memory of 2596 3428 colorcpl.exe 69 PID 3428 wrote to memory of 2596 3428 colorcpl.exe 69 PID 3428 wrote to memory of 2596 3428 colorcpl.exe 69 PID 3428 wrote to memory of 2896 3428 colorcpl.exe 71 PID 3428 wrote to memory of 2896 3428 colorcpl.exe 71 PID 3428 wrote to memory of 2896 3428 colorcpl.exe 71 -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3404 set thread context of 3432 3404 6dd7773f1243d53e392e0d6c8f2c9b6d.exe 67 PID 3432 set thread context of 3008 3432 ieinstal.exe 56 PID 3432 set thread context of 3008 3432 ieinstal.exe 56 PID 3428 set thread context of 3008 3428 colorcpl.exe 56 -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3432 ieinstal.exe Token: SeDebugPrivilege 3428 colorcpl.exe Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3432 ieinstal.exe 3432 ieinstal.exe 3432 ieinstal.exe 3432 ieinstal.exe 3432 ieinstal.exe 3432 ieinstal.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3432 ieinstal.exe 3432 ieinstal.exe 3432 ieinstal.exe 3432 ieinstal.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe 3428 colorcpl.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bfis = "C:\\Users\\Admin\\AppData\\Local\\Bfis\\Bfis.hta" 6dd7773f1243d53e392e0d6c8f2c9b6d.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\6dd7773f1243d53e392e0d6c8f2c9b6d.exe"C:\Users\Admin\AppData\Local\Temp\6dd7773f1243d53e392e0d6c8f2c9b6d.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:3404 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3432
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
PID:3428 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:2596
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2896
-
-