Analysis
- max time kernel
60s - max time network
64s - platform
windows7_x64 - resource
win7 - submitted
12/07/2020, 08:22
Static task
static1
Behavioral task
behavioral1
Sample
5e46a1a48700186e46692a36167a56ab.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 5e46a1a48700186e46692a36167a56ab.exe
- Size 457KB
- Sample200712-gexl9a61se
- SHA256 380cc04bea579540eaa9e5a2b4e89b6696736c02f1602dd51e5ebddf01e9e5da
- MD5 5e46a1a48700186e46692a36167a56ab
- SHA1 7880f3487fd0450f205e314061a15c7a8da827b5
- SHA512 4a83735e707694db2b9c010cb26330d5d737df45984701b7f4a6d891aaee7e6750b9b283bfb8bf06fc3e7a6e3cb9373f20e9ca5b43116f9fda1448350fc22485
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1492 5e46a1a48700186e46692a36167a56ab.exe 1492 5e46a1a48700186e46692a36167a56ab.exe 1492 5e46a1a48700186e46692a36167a56ab.exe 1492 5e46a1a48700186e46692a36167a56ab.exe - Loads dropped DLL 4 IoCs
pid Process 1492 5e46a1a48700186e46692a36167a56ab.exe 1492 5e46a1a48700186e46692a36167a56ab.exe 1492 5e46a1a48700186e46692a36167a56ab.exe 1492 5e46a1a48700186e46692a36167a56ab.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1848 taskkill.exe - Deletes itself 1 IoCs
pid Process 1776 cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5e46a1a48700186e46692a36167a56ab.exe - Kills process with taskkill 1 IoCs
pid Process 1848 taskkill.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1776 1492 5e46a1a48700186e46692a36167a56ab.exe 26 PID 1492 wrote to memory of 1776 1492 5e46a1a48700186e46692a36167a56ab.exe 26 PID 1492 wrote to memory of 1776 1492 5e46a1a48700186e46692a36167a56ab.exe 26 PID 1492 wrote to memory of 1776 1492 5e46a1a48700186e46692a36167a56ab.exe 26 PID 1776 wrote to memory of 1848 1776 cmd.exe 28 PID 1776 wrote to memory of 1848 1776 cmd.exe 28 PID 1776 wrote to memory of 1848 1776 cmd.exe 28 PID 1776 wrote to memory of 1848 1776 cmd.exe 28 - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Checks for installed software on the system 1 TTPs 29 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e46a1a48700186e46692a36167a56ab.exe"C:\Users\Admin\AppData\Local\Temp\5e46a1a48700186e46692a36167a56ab.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
- Checks for installed software on the system
PID:1492 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 5e46a1a48700186e46692a36167a56ab.exe /f & erase C:\Users\Admin\AppData\Local\Temp\5e46a1a48700186e46692a36167a56ab.exe & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im 5e46a1a48700186e46692a36167a56ab.exe /f3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1848
-
-