Analysis
- max time kernel
148s - max time network
148s - platform
windows7_x64 - resource
win7 - submitted
13/07/2020, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
Gkauepj.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Gkauepj.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Gkauepj.exe
- Size 1.1MB
- Sample200713-ej6cwvjm1x
- SHA256 0efa7703690d3fe9df70c81d7dea974aa710c7c55a76fd50e6a050bc76698d89
- MD5 23fa47d1c4f4ab3084b9bd6ea926bb16
- SHA1 26e854c6a1ee7af3f8a282caf06610b76ce21db9
- SHA512 4be080d2a86c01dd084dcbf4a4fcc7bfd5457f75d5fecbb70092b5703fee6f94f4a5aeda4831272eee19a346eb5ee96475af787fa45ad90be49e007bd68bd8a9
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NAPSTAT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\MRZPSJ78QZ = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" NAPSTAT.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NAPSTAT.EXE - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE - Adds Run entry to policy start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run NAPSTAT.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 600 ieinstal.exe 600 ieinstal.exe 600 ieinstal.exe 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Script User-Agent 2 IoCs
description flow ioc HTTP User-Agent header 5 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 600 ieinstal.exe Token: SeDebugPrivilege 1088 NAPSTAT.EXE - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 600 ieinstal.exe 600 ieinstal.exe 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE 1088 NAPSTAT.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 600 set thread context of 1268 600 ieinstal.exe 20 PID 1088 set thread context of 1268 1088 NAPSTAT.EXE 20 - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 284 wrote to memory of 600 284 Gkauepj.exe 24 PID 1268 wrote to memory of 1088 1268 Explorer.EXE 25 PID 1268 wrote to memory of 1088 1268 Explorer.EXE 25 PID 1268 wrote to memory of 1088 1268 Explorer.EXE 25 PID 1268 wrote to memory of 1088 1268 Explorer.EXE 25 PID 1088 wrote to memory of 1828 1088 NAPSTAT.EXE 27 PID 1088 wrote to memory of 1828 1088 NAPSTAT.EXE 27 PID 1088 wrote to memory of 1828 1088 NAPSTAT.EXE 27 PID 1088 wrote to memory of 1828 1088 NAPSTAT.EXE 27 PID 1088 wrote to memory of 1828 1088 NAPSTAT.EXE 27
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\Gkauepj.exe"C:\Users\Admin\AppData\Local\Temp\Gkauepj.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:600
-
-
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Adds Run entry to start application
- Modifies Internet Explorer settings
- Adds Run entry to policy start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1828
-
-