Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 14:27
Static task
static1
Behavioral task
behavioral1
Sample
Memorandum.exe
Resource
win7
Behavioral task
behavioral2
Sample
Memorandum.exe
Resource
win10v200430
General
-
Target
Memorandum.exe
-
Size
654KB
-
MD5
6ee086f9280e9b6dd55baeb5d247b8fc
-
SHA1
5492172488c392f929acb9b7cd775f940841eff0
-
SHA256
5749af95d51ba8e5d08b5724c8806a4e9fdd137ad4424ca2dd6f025a2662b421
-
SHA512
922be9587b623bae08f20eda65cc0ef7ce2960c3ebfee6a22709bf3976b0a1a553bcfd72fa7304b59bb1ba680d219537fe1c8bdd47c6833c039f3c09cd20b6e5
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Memorandum.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 744 Memorandum.exe Token: SeDebugPrivilege 1624 cmstp.exe Token: SeShutdownPrivilege 1228 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
cmstp.exedescription ioc process File opened for modification C:\Program Files (x86)\Ovfylpl\helpcbc.exe cmstp.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
cmstp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmstp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBCPJFP0 = "C:\\Program Files (x86)\\Ovfylpl\\helpcbc.exe" cmstp.exe -
Processes:
cmstp.exedescription ioc process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
Memorandum.exeMemorandum.execmstp.exepid process 1544 Memorandum.exe 744 Memorandum.exe 744 Memorandum.exe 744 Memorandum.exe 744 Memorandum.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
cmstp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cmstp.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Memorandum.exeExplorer.EXEcmstp.exedescription pid process target process PID 1544 wrote to memory of 744 1544 Memorandum.exe Memorandum.exe PID 1544 wrote to memory of 744 1544 Memorandum.exe Memorandum.exe PID 1544 wrote to memory of 744 1544 Memorandum.exe Memorandum.exe PID 1544 wrote to memory of 744 1544 Memorandum.exe Memorandum.exe PID 1228 wrote to memory of 1624 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1624 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1624 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1624 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1624 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1624 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1624 1228 Explorer.EXE cmstp.exe PID 1624 wrote to memory of 1036 1624 cmstp.exe cmd.exe PID 1624 wrote to memory of 1036 1624 cmstp.exe cmd.exe PID 1624 wrote to memory of 1036 1624 cmstp.exe cmd.exe PID 1624 wrote to memory of 1036 1624 cmstp.exe cmd.exe PID 1624 wrote to memory of 1988 1624 cmstp.exe Firefox.exe PID 1624 wrote to memory of 1988 1624 cmstp.exe Firefox.exe PID 1624 wrote to memory of 1988 1624 cmstp.exe Firefox.exe PID 1624 wrote to memory of 1988 1624 cmstp.exe Firefox.exe PID 1624 wrote to memory of 1988 1624 cmstp.exe Firefox.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Memorandum.exeMemorandum.execmstp.exedescription pid process target process PID 1544 set thread context of 744 1544 Memorandum.exe Memorandum.exe PID 744 set thread context of 1228 744 Memorandum.exe Explorer.EXE PID 744 set thread context of 1228 744 Memorandum.exe Explorer.EXE PID 1624 set thread context of 1228 1624 cmstp.exe Explorer.EXE -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1036 cmd.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Memorandum.exeMemorandum.execmstp.exepid process 1544 Memorandum.exe 744 Memorandum.exe 744 Memorandum.exe 744 Memorandum.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe 1624 cmstp.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- System policy modification
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologim.jpeg
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologrf.ini
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologri.ini
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologrv.ini
-
memory/744-1-0x000000000041E350-mapping.dmp
-
memory/744-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1036-5-0x0000000000000000-mapping.dmp
-
memory/1228-2-0x0000000007810000-0x000000000790D000-memory.dmpFilesize
1012KB
-
memory/1624-4-0x0000000000390000-0x00000000003A8000-memory.dmpFilesize
96KB
-
memory/1624-9-0x0000000003B80000-0x0000000003CBB000-memory.dmpFilesize
1.2MB
-
memory/1624-8-0x0000000074BB0000-0x0000000074CCD000-memory.dmpFilesize
1.1MB
-
memory/1624-7-0x00000000750B0000-0x00000000750BC000-memory.dmpFilesize
48KB
-
memory/1624-6-0x00000000007F0000-0x00000000008AC000-memory.dmpFilesize
752KB
-
memory/1624-3-0x0000000000000000-mapping.dmp
-
memory/1988-10-0x0000000000000000-mapping.dmp
-
memory/1988-11-0x000000013FE20000-0x000000013FEB3000-memory.dmpFilesize
588KB