Analysis
- max time kernel
136s - max time network
50s - platform
windows10_x64 - resource
win10v200430 - submitted
12/07/2020, 08:22
Static task
static1
Behavioral task
behavioral1
Sample
5e46a1a48700186e46692a36167a56ab.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 5e46a1a48700186e46692a36167a56ab.exe
- Size 457KB
- Sample200712-gexl9a61se
- SHA256 380cc04bea579540eaa9e5a2b4e89b6696736c02f1602dd51e5ebddf01e9e5da
- MD5 5e46a1a48700186e46692a36167a56ab
- SHA1 7880f3487fd0450f205e314061a15c7a8da827b5
- SHA512 4a83735e707694db2b9c010cb26330d5d737df45984701b7f4a6d891aaee7e6750b9b283bfb8bf06fc3e7a6e3cb9373f20e9ca5b43116f9fda1448350fc22485
- MD5 SHA1 SHA512
Malware Config
Signatures
- Kills process with taskkill 1 IoCs
pid Process 296 taskkill.exe - Loads dropped DLL 2 IoCs
pid Process 724 5e46a1a48700186e46692a36167a56ab.exe 724 5e46a1a48700186e46692a36167a56ab.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5e46a1a48700186e46692a36167a56ab.exe - Checks for installed software on the system 1 TTPs 28 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName 5e46a1a48700186e46692a36167a56ab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName 5e46a1a48700186e46692a36167a56ab.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 724 5e46a1a48700186e46692a36167a56ab.exe 724 5e46a1a48700186e46692a36167a56ab.exe 724 5e46a1a48700186e46692a36167a56ab.exe 724 5e46a1a48700186e46692a36167a56ab.exe 724 5e46a1a48700186e46692a36167a56ab.exe 724 5e46a1a48700186e46692a36167a56ab.exe 724 5e46a1a48700186e46692a36167a56ab.exe 724 5e46a1a48700186e46692a36167a56ab.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 724 wrote to memory of 976 724 5e46a1a48700186e46692a36167a56ab.exe 68 PID 724 wrote to memory of 976 724 5e46a1a48700186e46692a36167a56ab.exe 68 PID 724 wrote to memory of 976 724 5e46a1a48700186e46692a36167a56ab.exe 68 PID 976 wrote to memory of 296 976 cmd.exe 70 PID 976 wrote to memory of 296 976 cmd.exe 70 PID 976 wrote to memory of 296 976 cmd.exe 70 - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 296 taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e46a1a48700186e46692a36167a56ab.exe"C:\Users\Admin\AppData\Local\Temp\5e46a1a48700186e46692a36167a56ab.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 5e46a1a48700186e46692a36167a56ab.exe /f & erase C:\Users\Admin\AppData\Local\Temp\5e46a1a48700186e46692a36167a56ab.exe & exit2⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im 5e46a1a48700186e46692a36167a56ab.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:296
-
-