Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
12-07-2020 11:25
Static task
static1
Behavioral task
behavioral1
Sample
cS7il0zOGtdU05K.exe
Resource
win7
Behavioral task
behavioral2
Sample
cS7il0zOGtdU05K.exe
Resource
win10v200430
General
-
Target
cS7il0zOGtdU05K.exe
-
Size
364KB
-
MD5
b0cac1cdd3c9ab7d332811850ddd8ab9
-
SHA1
750deac873706d16c1180ac9c3eda6f435828c3e
-
SHA256
5300a0a0ca9bc1ac90ad1543fe3a1687db23b8f05194f86263938c57e0503b84
-
SHA512
ebf73440a56091edacee8f04eb61f7aba66f5ca024bb3a10937eb41462146ab48295a9419e0e44fc5c5ec47affa0baf212555411a5f3f09ca9a946e20c3372fc
Malware Config
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Drops file in Program Files directory 1 IoCs
Processes:
ipconfig.exedescription ioc process File opened for modification C:\Program Files (x86)\Brt-tq\colorcplxpidbb.exe ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
cS7il0zOGtdU05K.execS7il0zOGtdU05K.exeipconfig.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4004 cS7il0zOGtdU05K.exe Token: SeDebugPrivilege 3544 cS7il0zOGtdU05K.exe Token: SeDebugPrivilege 3940 ipconfig.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
cS7il0zOGtdU05K.execS7il0zOGtdU05K.exeipconfig.exedescription pid process target process PID 4004 set thread context of 3544 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 3544 set thread context of 3044 3544 cS7il0zOGtdU05K.exe Explorer.EXE PID 3940 set thread context of 3044 3940 ipconfig.exe Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
ipconfig.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ipconfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZLDDTR28AP = "C:\\Program Files (x86)\\Brt-tq\\colorcplxpidbb.exe" ipconfig.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
cS7il0zOGtdU05K.exeExplorer.EXEipconfig.exedescription pid process target process PID 4004 wrote to memory of 2784 4004 cS7il0zOGtdU05K.exe schtasks.exe PID 4004 wrote to memory of 2784 4004 cS7il0zOGtdU05K.exe schtasks.exe PID 4004 wrote to memory of 2784 4004 cS7il0zOGtdU05K.exe schtasks.exe PID 4004 wrote to memory of 3896 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3896 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3896 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3996 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3996 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3996 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3208 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3208 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3208 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3892 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3892 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3892 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3544 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3544 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3544 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3544 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3544 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 4004 wrote to memory of 3544 4004 cS7il0zOGtdU05K.exe cS7il0zOGtdU05K.exe PID 3044 wrote to memory of 3940 3044 Explorer.EXE ipconfig.exe PID 3044 wrote to memory of 3940 3044 Explorer.EXE ipconfig.exe PID 3044 wrote to memory of 3940 3044 Explorer.EXE ipconfig.exe PID 3940 wrote to memory of 3260 3940 ipconfig.exe cmd.exe PID 3940 wrote to memory of 3260 3940 ipconfig.exe cmd.exe PID 3940 wrote to memory of 3260 3940 ipconfig.exe cmd.exe PID 3940 wrote to memory of 3396 3940 ipconfig.exe cmd.exe PID 3940 wrote to memory of 3396 3940 ipconfig.exe cmd.exe PID 3940 wrote to memory of 3396 3940 ipconfig.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
cS7il0zOGtdU05K.execS7il0zOGtdU05K.exeipconfig.exepid process 4004 cS7il0zOGtdU05K.exe 4004 cS7il0zOGtdU05K.exe 4004 cS7il0zOGtdU05K.exe 4004 cS7il0zOGtdU05K.exe 4004 cS7il0zOGtdU05K.exe 4004 cS7il0zOGtdU05K.exe 4004 cS7il0zOGtdU05K.exe 4004 cS7il0zOGtdU05K.exe 3544 cS7il0zOGtdU05K.exe 3544 cS7il0zOGtdU05K.exe 3544 cS7il0zOGtdU05K.exe 3544 cS7il0zOGtdU05K.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe 3940 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cS7il0zOGtdU05K.exeipconfig.exepid process 3544 cS7il0zOGtdU05K.exe 3544 cS7il0zOGtdU05K.exe 3544 cS7il0zOGtdU05K.exe 3940 ipconfig.exe 3940 ipconfig.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cS7il0zOGtdU05K.exe"C:\Users\Admin\AppData\Local\Temp\cS7il0zOGtdU05K.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SfeAvvANvSVV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84C6.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\cS7il0zOGtdU05K.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\cS7il0zOGtdU05K.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\cS7il0zOGtdU05K.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\cS7il0zOGtdU05K.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\cS7il0zOGtdU05K.exe"{path}"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\cS7il0zOGtdU05K.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
C:\Users\Admin\AppData\Local\Temp\tmp84C6.tmp
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logim.jpeg
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrg.ini
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logri.ini
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrv.ini
-
memory/2784-0-0x0000000000000000-mapping.dmp
-
memory/3260-7-0x0000000000000000-mapping.dmp
-
memory/3396-10-0x0000000000000000-mapping.dmp
-
memory/3544-3-0x000000000041B6E0-mapping.dmp
-
memory/3544-2-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3940-8-0x0000000000C10000-0x0000000000CC3000-memory.dmpFilesize
716KB
-
memory/3940-6-0x0000000000CD0000-0x0000000000CDB000-memory.dmpFilesize
44KB
-
memory/3940-5-0x0000000000CD0000-0x0000000000CDB000-memory.dmpFilesize
44KB
-
memory/3940-4-0x0000000000000000-mapping.dmp