Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 14:27
Static task
static1
Behavioral task
behavioral1
Sample
Memorandum.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Memorandum.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
Memorandum.exe
-
Size
654KB
-
MD5
6ee086f9280e9b6dd55baeb5d247b8fc
-
SHA1
5492172488c392f929acb9b7cd775f940841eff0
-
SHA256
5749af95d51ba8e5d08b5724c8806a4e9fdd137ad4424ca2dd6f025a2662b421
-
SHA512
922be9587b623bae08f20eda65cc0ef7ce2960c3ebfee6a22709bf3976b0a1a553bcfd72fa7304b59bb1ba680d219537fe1c8bdd47c6833c039f3c09cd20b6e5
Score
10/10
Malware Config
Signatures
-
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Drops file in Program Files directory 1 IoCs
Processes:
chkdsk.exedescription ioc process File opened for modification C:\Program Files (x86)\T02e\xv7dw4jxvhf.exe chkdsk.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
chkdsk.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HBCLAJQ8AV = "C:\\Program Files (x86)\\T02e\\xv7dw4jxvhf.exe" chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
Memorandum.exeMemorandum.exechkdsk.exepid process 3848 Memorandum.exe 3848 Memorandum.exe 2036 Memorandum.exe 2036 Memorandum.exe 2036 Memorandum.exe 2036 Memorandum.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Memorandum.exeExplorer.EXEchkdsk.exedescription pid process target process PID 3848 wrote to memory of 2036 3848 Memorandum.exe Memorandum.exe PID 3848 wrote to memory of 2036 3848 Memorandum.exe Memorandum.exe PID 3848 wrote to memory of 2036 3848 Memorandum.exe Memorandum.exe PID 2996 wrote to memory of 756 2996 Explorer.EXE chkdsk.exe PID 2996 wrote to memory of 756 2996 Explorer.EXE chkdsk.exe PID 2996 wrote to memory of 756 2996 Explorer.EXE chkdsk.exe PID 756 wrote to memory of 1512 756 chkdsk.exe cmd.exe PID 756 wrote to memory of 1512 756 chkdsk.exe cmd.exe PID 756 wrote to memory of 1512 756 chkdsk.exe cmd.exe PID 756 wrote to memory of 3740 756 chkdsk.exe cmd.exe PID 756 wrote to memory of 3740 756 chkdsk.exe cmd.exe PID 756 wrote to memory of 3740 756 chkdsk.exe cmd.exe PID 756 wrote to memory of 3660 756 chkdsk.exe Firefox.exe PID 756 wrote to memory of 3660 756 chkdsk.exe Firefox.exe PID 756 wrote to memory of 3660 756 chkdsk.exe Firefox.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
Memorandum.exeMemorandum.exechkdsk.exepid process 3848 Memorandum.exe 2036 Memorandum.exe 2036 Memorandum.exe 2036 Memorandum.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe 756 chkdsk.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Memorandum.exeMemorandum.exechkdsk.exedescription pid process target process PID 3848 set thread context of 2036 3848 Memorandum.exe Memorandum.exe PID 2036 set thread context of 2996 2036 Memorandum.exe Explorer.EXE PID 756 set thread context of 2996 756 chkdsk.exe Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
Memorandum.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2036 Memorandum.exe Token: SeDebugPrivilege 756 chkdsk.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Modifies Internet Explorer settings
- Enumerates system info in registry
- Drops file in Program Files directory
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Memorandum.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologim.jpeg
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologrf.ini
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologrg.ini
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologri.ini
-
C:\Users\Admin\AppData\Roaming\79OQ87VU\79Ologrv.ini
-
memory/756-4-0x0000000000C00000-0x0000000000C0A000-memory.dmpFilesize
40KB
-
memory/756-3-0x0000000000C00000-0x0000000000C0A000-memory.dmpFilesize
40KB
-
memory/756-2-0x0000000000000000-mapping.dmp
-
memory/1512-5-0x0000000000000000-mapping.dmp
-
memory/2036-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2036-1-0x000000000041E350-mapping.dmp
-
memory/3660-11-0x0000000000000000-mapping.dmp
-
memory/3660-12-0x00007FF6A8DD0000-0x00007FF6A8E63000-memory.dmpFilesize
588KB
-
memory/3660-13-0x00007FF6A8DD0000-0x00007FF6A8E63000-memory.dmpFilesize
588KB
-
memory/3660-14-0x00007FF6A8DD0000-0x00007FF6A8E63000-memory.dmpFilesize
588KB
-
memory/3740-8-0x0000000000000000-mapping.dmp