Analysis
-
max time kernel
117s -
max time network
143s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 12:04
Static task
static1
Behavioral task
behavioral1
Sample
Guqcvju_Signed_.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Guqcvju_Signed_.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Guqcvju_Signed_.exe
-
Size
1.1MB
-
MD5
271646d2ae5f0c7693be133688eaca38
-
SHA1
fce0e671122419cbb94f9651039323e945960964
-
SHA256
b2ebc0f8c302a04961b8c2ed0673384050e5932a370be062788b7630bf188123
-
SHA512
263656c10302a5ae39d3712b7bcbf8424b46bb98132bdb1f659baebba72eb1e166e5af4b63ad83e4b458fc4547ebcb1b7be62c18e4dd3622fdcf8067f40fe3b7
Score
8/10
Malware Config
Signatures
-
Modifies registry key 1 TTPs 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Script User-Agent 1 IoCs
Processes:
description flow ioc HTTP User-Agent header 5 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 527 IoCs
Processes:
Guqcvju_Signed_.exedescription pid process target process PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe PID 1496 wrote to memory of 748 1496 Guqcvju_Signed_.exe TapiUnattend.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Guqcvju_Signed_.exedescription pid process target process PID 1496 set thread context of 2368 1496 Guqcvju_Signed_.exe ieinstal.exe -
Loads dropped DLL 6 IoCs
Processes:
ieinstal.exepid process 2368 ieinstal.exe 2368 ieinstal.exe 2368 ieinstal.exe 2368 ieinstal.exe 2368 ieinstal.exe 2368 ieinstal.exe -
Executes dropped EXE 2 IoCs
Processes:
fodhelper.exefodhelper.exepid process 2648 fodhelper.exe 2672 fodhelper.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
Guqcvju_Signed_.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Guqc = "C:\\Users\\Admin\\AppData\\Local\\Guqc\\Guqc.hta" Guqcvju_Signed_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Guqcvju_Signed_.exe"C:\Users\Admin\AppData\Local\Temp\Guqcvju_Signed_.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:1496 -
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"2⤵PID:748
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat3⤵PID:2348
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2408 -
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:2420 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:2432
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2520 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Runex.bat3⤵PID:2600
-
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
PID:2648 -
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
PID:2672 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
- Loads dropped DLL
PID:2368