Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10 -
submitted
09-07-2020 21:31
Static task
static1
Behavioral task
behavioral1
Sample
UNGO PAYMENT FORM08656049_DOC.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
UNGO PAYMENT FORM08656049_DOC.exe
Resource
win10
General
-
Target
UNGO PAYMENT FORM08656049_DOC.exe
-
Size
831KB
-
MD5
5310d3ed86e4e68a0d657ed3bb30acd5
-
SHA1
a4d46ab83ac7e30492b061e4ac95b9f5dd2e8905
-
SHA256
dea3774e5c5ae207131be64dec69219c8e0274ee90efc6914ceaedf551f255c6
-
SHA512
1768202776abb2bfccc2efcaa1024c46ca20f83d3e87fdb9739c03f838ff48df52241134fdd68376c8fe644492271d3f6366edff6ae9c3fb848cb593a0145dce
Malware Config
Signatures
-
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 66 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exeUNGO PAYMENT FORM08656049_DOC.exeipconfig.exeyvmphdzhgfip8.exeyvmphdzhgfip8.exepid process 3684 UNGO PAYMENT FORM08656049_DOC.exe 3684 UNGO PAYMENT FORM08656049_DOC.exe 3896 UNGO PAYMENT FORM08656049_DOC.exe 3896 UNGO PAYMENT FORM08656049_DOC.exe 3896 UNGO PAYMENT FORM08656049_DOC.exe 3896 UNGO PAYMENT FORM08656049_DOC.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 848 yvmphdzhgfip8.exe 848 yvmphdzhgfip8.exe 744 yvmphdzhgfip8.exe 744 yvmphdzhgfip8.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exeExplorer.EXEipconfig.exeyvmphdzhgfip8.exedescription pid process target process PID 3684 wrote to memory of 3896 3684 UNGO PAYMENT FORM08656049_DOC.exe UNGO PAYMENT FORM08656049_DOC.exe PID 3684 wrote to memory of 3896 3684 UNGO PAYMENT FORM08656049_DOC.exe UNGO PAYMENT FORM08656049_DOC.exe PID 3684 wrote to memory of 3896 3684 UNGO PAYMENT FORM08656049_DOC.exe UNGO PAYMENT FORM08656049_DOC.exe PID 3020 wrote to memory of 3292 3020 Explorer.EXE ipconfig.exe PID 3020 wrote to memory of 3292 3020 Explorer.EXE ipconfig.exe PID 3020 wrote to memory of 3292 3020 Explorer.EXE ipconfig.exe PID 3292 wrote to memory of 3860 3292 ipconfig.exe cmd.exe PID 3292 wrote to memory of 3860 3292 ipconfig.exe cmd.exe PID 3292 wrote to memory of 3860 3292 ipconfig.exe cmd.exe PID 3292 wrote to memory of 3528 3292 ipconfig.exe cmd.exe PID 3292 wrote to memory of 3528 3292 ipconfig.exe cmd.exe PID 3292 wrote to memory of 3528 3292 ipconfig.exe cmd.exe PID 3292 wrote to memory of 1608 3292 ipconfig.exe Firefox.exe PID 3292 wrote to memory of 1608 3292 ipconfig.exe Firefox.exe PID 3292 wrote to memory of 1608 3292 ipconfig.exe Firefox.exe PID 3020 wrote to memory of 848 3020 Explorer.EXE yvmphdzhgfip8.exe PID 3020 wrote to memory of 848 3020 Explorer.EXE yvmphdzhgfip8.exe PID 3020 wrote to memory of 848 3020 Explorer.EXE yvmphdzhgfip8.exe PID 848 wrote to memory of 744 848 yvmphdzhgfip8.exe yvmphdzhgfip8.exe PID 848 wrote to memory of 744 848 yvmphdzhgfip8.exe yvmphdzhgfip8.exe PID 848 wrote to memory of 744 848 yvmphdzhgfip8.exe yvmphdzhgfip8.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exeUNGO PAYMENT FORM08656049_DOC.exeipconfig.exeyvmphdzhgfip8.exedescription pid process target process PID 3684 set thread context of 3896 3684 UNGO PAYMENT FORM08656049_DOC.exe UNGO PAYMENT FORM08656049_DOC.exe PID 3896 set thread context of 3020 3896 UNGO PAYMENT FORM08656049_DOC.exe Explorer.EXE PID 3292 set thread context of 3020 3292 ipconfig.exe Explorer.EXE PID 848 set thread context of 744 848 yvmphdzhgfip8.exe yvmphdzhgfip8.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exeipconfig.exeExplorer.EXEyvmphdzhgfip8.exedescription pid process Token: SeDebugPrivilege 3896 UNGO PAYMENT FORM08656049_DOC.exe Token: SeDebugPrivilege 3292 ipconfig.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeDebugPrivilege 744 yvmphdzhgfip8.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Executes dropped EXE 2 IoCs
Processes:
yvmphdzhgfip8.exeyvmphdzhgfip8.exepid process 848 yvmphdzhgfip8.exe 744 yvmphdzhgfip8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System policy modification 1 TTPs 1 IoCs
Processes:
ipconfig.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ipconfig.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exeUNGO PAYMENT FORM08656049_DOC.exeipconfig.exeyvmphdzhgfip8.exepid process 3684 UNGO PAYMENT FORM08656049_DOC.exe 3896 UNGO PAYMENT FORM08656049_DOC.exe 3896 UNGO PAYMENT FORM08656049_DOC.exe 3896 UNGO PAYMENT FORM08656049_DOC.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 3292 ipconfig.exe 848 yvmphdzhgfip8.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
ipconfig.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HV18FTBPB4A = "C:\\Program Files (x86)\\R6lmxb2\\yvmphdzhgfip8.exe" ipconfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ipconfig.exe -
Drops file in Program Files directory 4 IoCs
Processes:
ipconfig.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe ipconfig.exe File opened for modification C:\Program Files (x86)\R6lmxb2 Explorer.EXE File created C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe Explorer.EXE File opened for modification C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- System policy modification
- Suspicious behavior: MapViewOfSection
- Adds Run entry to policy start application
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe"C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
-
C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe"C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe
-
C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe
-
C:\Program Files (x86)\R6lmxb2\yvmphdzhgfip8.exe
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
memory/744-18-0x000000000041C210-mapping.dmp
-
memory/848-14-0x0000000000000000-mapping.dmp
-
memory/1608-12-0x00007FF7ADB50000-0x00007FF7ADBE3000-memory.dmpFilesize
588KB
-
memory/1608-10-0x0000000000000000-mapping.dmp
-
memory/1608-11-0x00007FF7ADB50000-0x00007FF7ADBE3000-memory.dmpFilesize
588KB
-
memory/1608-13-0x00007FF7ADB50000-0x00007FF7ADBE3000-memory.dmpFilesize
588KB
-
memory/3292-6-0x0000000004A80000-0x0000000004B8E000-memory.dmpFilesize
1.1MB
-
memory/3292-9-0x00000000069A0000-0x0000000006ACE000-memory.dmpFilesize
1.2MB
-
memory/3292-4-0x0000000000E50000-0x0000000000E5B000-memory.dmpFilesize
44KB
-
memory/3292-3-0x0000000000E50000-0x0000000000E5B000-memory.dmpFilesize
44KB
-
memory/3292-2-0x0000000000000000-mapping.dmp
-
memory/3528-7-0x0000000000000000-mapping.dmp
-
memory/3860-5-0x0000000000000000-mapping.dmp
-
memory/3896-0-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/3896-1-0x000000000041C210-mapping.dmp