Overview

overview

10

Static

static

2Owjjl45F6zxq40.exe

windows7_x64

7

2Owjjl45F6zxq40.exe

windows10_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    12-07-2020 11:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2Owjjl45F6zxq40.exe

  • Size

    475KB

  • MD5

    5a27d64f2afc5755986ed501f2561f00

  • SHA1

    017c299bc06a8631b0646b732824dc33f0f74566

  • SHA256

    2f645ad832ecb3de614ff355e67bb7db84812294921a247f7ce1c8b9667f56d0

  • SHA512

    7ae558dc146c971ed0457d0a006269c6431375f2fb2c2fea88376ff968aafd4361ffb48ee371a53584c6e7e18354714d8b40f9bc87344e8b3f552d3910ead481

Score
10/10
persistencespywaretrojanstealerformbook

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 18 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Adds Run entry to policy start application 2 TTPs 2 IoCs
    persistence
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\2Owjjl45F6zxq40.exe
      "C:\Users\Admin\AppData\Local\Temp\2Owjjl45F6zxq40.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:3828
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SZoiOuCCsbejrq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp78C5.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:3856
      • C:\Users\Admin\AppData\Local\Temp\2Owjjl45F6zxq40.exe
        "{path}"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        PID:3336
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: MapViewOfSection
      • System policy modification
      • Modifies Internet Explorer settings
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      • Drops file in Program Files directory
      • Adds Run entry to policy start application
      PID:1668
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\2Owjjl45F6zxq40.exe"
        3⤵
          PID:3832
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:1592
      • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
        C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
        1⤵
          PID:3908

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Modify Registry

        3
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\DB1
          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\tmp78C5.tmp
          Download Submit
        • C:\Users\Admin\AppData\Roaming\JN052U35\JN0logim.jpeg
          Download Submit
        • C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrg.ini
          Download Submit
        • C:\Users\Admin\AppData\Roaming\JN052U35\JN0logri.ini
          Download Submit
        • C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrv.ini
          Download Submit
        • memory/1592-10-0x0000000000000000-mapping.dmp
          Download
        • memory/1668-7-0x0000000000CC0000-0x0000000000CCC000-memory.dmp
          Filesize

          48KB

          Download
        • memory/1668-6-0x0000000000CC0000-0x0000000000CCC000-memory.dmp
          Filesize

          48KB

          Download
        • memory/1668-5-0x0000000000000000-mapping.dmp
          Download
        • memory/3336-3-0x000000000041B6E0-mapping.dmp
          Download
        • memory/3336-2-0x0000000000400000-0x000000000042A000-memory.dmp
          Filesize

          168KB

          Download
        • memory/3832-8-0x0000000000000000-mapping.dmp
          Download
        • memory/3856-0-0x0000000000000000-mapping.dmp
          Download