Overview

overview

10

Static

static

nDpCRftIevGVro2.exe

windows7_x64

7

nDpCRftIevGVro2.exe

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    12/07/2020, 08:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    nDpCRftIevGVro2.exe

  • Size

    909KB

  • MD5

    99ee30484749b90ac5ca3e2a776a0198

  • SHA1

    ac6b11d0a4ebf636008cf1d39f4889b2c55ae0bc

  • SHA256

    ee82b7263174f6d14a23263058616fda1c4676cecf6d0003696d255147963e1b

  • SHA512

    606727a606b7a95ff1ed285c9b9ac61c4c29e05b5fa48c337ba394e8151c9e96678109203f9df2e20d4bbe16be70674c58a673d4332af1b146e7f80784a36a31

Score
10/10
persistencespywaretrojanstealerformbook

Malware Config

Signatures

  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Adds Run entry to start application 2 TTPs 2 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    PID:3004
    • C:\Users\Admin\AppData\Local\Temp\nDpCRftIevGVro2.exe
      "C:\Users\Admin\AppData\Local\Temp\nDpCRftIevGVro2.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      PID:3848
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wjmzDTcOC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp85A1.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2160
      • C:\Users\Admin\AppData\Local\Temp\nDpCRftIevGVro2.exe
        "{path}"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2624
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Adds Run entry to start application
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Drops file in Program Files directory
      PID:2868
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\nDpCRftIevGVro2.exe"
        3⤵
          PID:3768
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:3540

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2624-2-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

        Download

      • memory/2868-6-0x00000000012E0000-0x00000000012EC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2868-7-0x00000000012E0000-0x00000000012EC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2868-9-0x00000000054C0000-0x000000000558E000-memory.dmp

        Filesize

        824KB

        Download