Analysis
- max time kernel
145s - max time network
141s - platform
windows10_x64 - resource
win10 - submitted
10/07/2020, 16:51
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Request_20202605_20202605_20202605PDF.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation Request_20202605_20202605_20202605PDF.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Quotation Request_20202605_20202605_20202605PDF.exe
- Size 799KB
- Sample200710-beggmapc2a
- SHA256 0edc17effc79112df8aadfd138cc3db51ecb97c7ed54668f1b17a216f45eb5ab
- MD5 3559e364b7c596a65354dd0f1b5934b3
- SHA1 781a43a293408d96f536446e959775f87810f416
- SHA512 4cc77768265efd83b95abbf98bb2e654a21e62c8b5f36bdf18ce7995f7994cd737a77157dbbe03abe9eff45f353be0b6631052b3032cecf37d60ed36006ff747
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3040 Quotation Request_20202605_20202605_20202605PDF.exe Token: SeDebugPrivilege 3268 NETSTAT.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3040 Quotation Request_20202605_20202605_20202605PDF.exe 3040 Quotation Request_20202605_20202605_20202605PDF.exe 3040 Quotation Request_20202605_20202605_20202605PDF.exe 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Oqzr8ftbp\_nid2d9l_.exe NETSTAT.EXE - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3588 wrote to memory of 3040 3588 Quotation Request_20202605_20202605_20202605PDF.exe 67 PID 3588 wrote to memory of 3040 3588 Quotation Request_20202605_20202605_20202605PDF.exe 67 PID 3588 wrote to memory of 3040 3588 Quotation Request_20202605_20202605_20202605PDF.exe 67 PID 3588 wrote to memory of 3040 3588 Quotation Request_20202605_20202605_20202605PDF.exe 67 PID 3588 wrote to memory of 3040 3588 Quotation Request_20202605_20202605_20202605PDF.exe 67 PID 3588 wrote to memory of 3040 3588 Quotation Request_20202605_20202605_20202605PDF.exe 67 PID 2988 wrote to memory of 3268 2988 Explorer.EXE 68 PID 2988 wrote to memory of 3268 2988 Explorer.EXE 68 PID 2988 wrote to memory of 3268 2988 Explorer.EXE 68 PID 3268 wrote to memory of 3832 3268 NETSTAT.EXE 69 PID 3268 wrote to memory of 3832 3268 NETSTAT.EXE 69 PID 3268 wrote to memory of 3832 3268 NETSTAT.EXE 69 PID 3268 wrote to memory of 632 3268 NETSTAT.EXE 77 PID 3268 wrote to memory of 632 3268 NETSTAT.EXE 77 PID 3268 wrote to memory of 632 3268 NETSTAT.EXE 77 PID 3268 wrote to memory of 932 3268 NETSTAT.EXE 79 PID 3268 wrote to memory of 932 3268 NETSTAT.EXE 79 PID 3268 wrote to memory of 932 3268 NETSTAT.EXE 79 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3588 set thread context of 3040 3588 Quotation Request_20202605_20202605_20202605PDF.exe 67 PID 3040 set thread context of 2988 3040 Quotation Request_20202605_20202605_20202605PDF.exe 56 PID 3268 set thread context of 2988 3268 NETSTAT.EXE 56 - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3040 Quotation Request_20202605_20202605_20202605PDF.exe 3040 Quotation Request_20202605_20202605_20202605PDF.exe 3040 Quotation Request_20202605_20202605_20202605PDF.exe 3040 Quotation Request_20202605_20202605_20202605PDF.exe 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE 3268 NETSTAT.EXE - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run NETSTAT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\D8E4RNN80FJ = "C:\\Program Files (x86)\\Oqzr8ftbp\\_nid2d9l_.exe" NETSTAT.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\Quotation Request_20202605_20202605_20202605PDF.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request_20202605_20202605_20202605PDF.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\Quotation Request_20202605_20202605_20202605PDF.exe"{path}"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3040
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Modifies Internet Explorer settings
PID:3268 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation Request_20202605_20202605_20202605PDF.exe"3⤵PID:3832
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:632
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:932
-
-