Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
10/07/2020, 11:52
Static task
static1
Behavioral task
behavioral1
Sample
winlog.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
winlog.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
winlog.exe
-
Size
341KB
-
MD5
2fafa52942af93554281b81a68b681f4
-
SHA1
33d7ed40057254ce4bcb87850febff71d46177c0
-
SHA256
1940c74c0c28f1bc9e66ffc90e00094601b5c2f7a68f1a034626ccf4969d54c8
-
SHA512
ca21c2390d9fa73f9b552384da0b6001cde589904dce687dec21f711830038a0526e2e784936a938f564624351a6bafcba25613cc7858e987f74ba07f05447c1
Score
10/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 392 cmd.exe Token: SeDebugPrivilege 3772 cmstp.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmstp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LFL4MZJ0QZ = "C:\\Program Files (x86)\\M2do\\q4rpmba.exe" cmstp.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe -
Loads dropped DLL 3 IoCs
pid Process 640 winlog.exe 640 winlog.exe 852 rundll32.exe -
Suspicious use of WriteProcessMemory 99 IoCs
description pid Process procid_target PID 640 wrote to memory of 852 640 winlog.exe 66 PID 640 wrote to memory of 852 640 winlog.exe 66 PID 640 wrote to memory of 852 640 winlog.exe 66 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 852 wrote to memory of 392 852 rundll32.exe 67 PID 3024 wrote to memory of 3772 3024 Explorer.EXE 76 PID 3024 wrote to memory of 3772 3024 Explorer.EXE 76 PID 3024 wrote to memory of 3772 3024 Explorer.EXE 76 PID 3772 wrote to memory of 1852 3772 cmstp.exe 77 PID 3772 wrote to memory of 1852 3772 cmstp.exe 77 PID 3772 wrote to memory of 1852 3772 cmstp.exe 77 PID 3772 wrote to memory of 424 3772 cmstp.exe 79 PID 3772 wrote to memory of 424 3772 cmstp.exe 79 PID 3772 wrote to memory of 424 3772 cmstp.exe 79 PID 3772 wrote to memory of 3744 3772 cmstp.exe 81 PID 3772 wrote to memory of 3744 3772 cmstp.exe 81 PID 3772 wrote to memory of 3744 3772 cmstp.exe 81 -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 852 rundll32.exe 392 cmd.exe 392 cmd.exe 392 cmd.exe 392 cmd.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 852 rundll32.exe 392 cmd.exe 392 cmd.exe 392 cmd.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe 3772 cmstp.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 392 set thread context of 3024 392 cmd.exe 56 PID 3772 set thread context of 3024 3772 cmstp.exe 56 -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3024 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\M2do\q4rpmba.exe cmstp.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\winlog.exe"C:\Users\Admin\AppData\Local\Temp\winlog.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Ulotrichy,Screening3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:852 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:392
-
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:3772 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:1852
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:424
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3744
-
-