Analysis
- max time kernel
147s - max time network
134s - platform
windows10_x64 - resource
win10v200430 - submitted
10/07/2020, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
2fafa52942af93554281b81a68b681f4.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2fafa52942af93554281b81a68b681f4.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target 2fafa52942af93554281b81a68b681f4.exe
- Size 341KB
- Sample200710-85kk58nwxa
- SHA256 1940c74c0c28f1bc9e66ffc90e00094601b5c2f7a68f1a034626ccf4969d54c8
- MD5 2fafa52942af93554281b81a68b681f4
- SHA1 33d7ed40057254ce4bcb87850febff71d46177c0
- SHA512 ca21c2390d9fa73f9b552384da0b6001cde589904dce687dec21f711830038a0526e2e784936a938f564624351a6bafcba25613cc7858e987f74ba07f05447c1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 1816 cmd.exe 1816 cmd.exe 1816 cmd.exe 1816 cmd.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1816 cmd.exe Token: SeDebugPrivilege 1688 control.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1816 set thread context of 3024 1816 cmd.exe 56 PID 1688 set thread context of 3024 1688 control.exe 56 - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3024 Explorer.EXE - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer control.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\NJ9L_RC06DS = "C:\\Program Files (x86)\\Zn8tpzlg\\mfc5jux9ju.exe" control.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run control.exe - Loads dropped DLL 3 IoCs
pid Process 1616 2fafa52942af93554281b81a68b681f4.exe 1616 2fafa52942af93554281b81a68b681f4.exe 3716 rundll32.exe - Suspicious use of WriteProcessMemory 117 IoCs
description pid Process procid_target PID 1616 wrote to memory of 3716 1616 2fafa52942af93554281b81a68b681f4.exe 68 PID 1616 wrote to memory of 3716 1616 2fafa52942af93554281b81a68b681f4.exe 68 PID 1616 wrote to memory of 3716 1616 2fafa52942af93554281b81a68b681f4.exe 68 PID 3716 wrote to memory of 1784 3716 rundll32.exe 69 PID 3716 wrote to memory of 1784 3716 rundll32.exe 69 PID 3716 wrote to memory of 1784 3716 rundll32.exe 69 PID 3716 wrote to memory of 1784 3716 rundll32.exe 69 PID 3716 wrote to memory of 1784 3716 rundll32.exe 69 PID 3716 wrote to memory of 1784 3716 rundll32.exe 69 PID 3716 wrote to memory of 1784 3716 rundll32.exe 69 PID 3716 wrote to memory of 1784 3716 rundll32.exe 69 PID 3716 wrote to memory of 1784 3716 rundll32.exe 69 PID 3716 wrote to memory of 1788 3716 rundll32.exe 70 PID 3716 wrote to memory of 1788 3716 rundll32.exe 70 PID 3716 wrote to memory of 1788 3716 rundll32.exe 70 PID 3716 wrote to memory of 1788 3716 rundll32.exe 70 PID 3716 wrote to memory of 1788 3716 rundll32.exe 70 PID 3716 wrote to memory of 1788 3716 rundll32.exe 70 PID 3716 wrote to memory of 1788 3716 rundll32.exe 70 PID 3716 wrote to memory of 1788 3716 rundll32.exe 70 PID 3716 wrote to memory of 1788 3716 rundll32.exe 70 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3716 wrote to memory of 1816 3716 rundll32.exe 71 PID 3024 wrote to memory of 1688 3024 Explorer.EXE 78 PID 3024 wrote to memory of 1688 3024 Explorer.EXE 78 PID 3024 wrote to memory of 1688 3024 Explorer.EXE 78 PID 1688 wrote to memory of 3084 1688 control.exe 79 PID 1688 wrote to memory of 3084 1688 control.exe 79 PID 1688 wrote to memory of 3084 1688 control.exe 79 PID 1688 wrote to memory of 1296 1688 control.exe 81 PID 1688 wrote to memory of 1296 1688 control.exe 81 PID 1688 wrote to memory of 1296 1688 control.exe 81 PID 1688 wrote to memory of 1104 1688 control.exe 83 PID 1688 wrote to memory of 1104 1688 control.exe 83 PID 1688 wrote to memory of 1104 1688 control.exe 83 - Suspicious behavior: MapViewOfSection 10 IoCs
pid Process 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 1816 cmd.exe 1816 cmd.exe 1816 cmd.exe 1688 control.exe 1688 control.exe 1688 control.exe 1688 control.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Zn8tpzlg\mfc5jux9ju.exe control.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2fafa52942af93554281b81a68b681f4.exe"C:\Users\Admin\AppData\Local\Temp\2fafa52942af93554281b81a68b681f4.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Ulotrichy,Screening3⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:3716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1784
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1788
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1816
-
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- System policy modification
- Adds Run entry to policy start application
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
- Drops file in Program Files directory
PID:1688 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:3084
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1296
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1104
-
-