Analysis
- max time kernel
147s - max time network
146s - platform
windows10_x64 - resource
win10 - submitted
13/07/2020, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
Gkauepj.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Gkauepj.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Gkauepj.exe
- Size 1.1MB
- Sample200713-ej6cwvjm1x
- SHA256 0efa7703690d3fe9df70c81d7dea974aa710c7c55a76fd50e6a050bc76698d89
- MD5 23fa47d1c4f4ab3084b9bd6ea926bb16
- SHA1 26e854c6a1ee7af3f8a282caf06610b76ce21db9
- SHA512 4be080d2a86c01dd084dcbf4a4fcc7bfd5457f75d5fecbb70092b5703fee6f94f4a5aeda4831272eee19a346eb5ee96475af787fa45ad90be49e007bd68bd8a9
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\7NL0CV_H18 = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" cmd.exe - Adds Run entry to policy start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmd.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 976 wrote to memory of 3944 976 Gkauepj.exe 67 PID 976 wrote to memory of 3944 976 Gkauepj.exe 67 PID 976 wrote to memory of 3944 976 Gkauepj.exe 67 PID 976 wrote to memory of 3944 976 Gkauepj.exe 67 PID 976 wrote to memory of 3944 976 Gkauepj.exe 67 PID 976 wrote to memory of 3944 976 Gkauepj.exe 67 PID 3008 wrote to memory of 3820 3008 Explorer.EXE 68 PID 3008 wrote to memory of 3820 3008 Explorer.EXE 68 PID 3008 wrote to memory of 3820 3008 Explorer.EXE 68 PID 3820 wrote to memory of 3516 3820 cmd.exe 69 PID 3820 wrote to memory of 3516 3820 cmd.exe 69 PID 3820 wrote to memory of 3516 3820 cmd.exe 69 PID 3820 wrote to memory of 2572 3820 cmd.exe 71 PID 3820 wrote to memory of 2572 3820 cmd.exe 71 PID 3820 wrote to memory of 2572 3820 cmd.exe 71 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3944 set thread context of 3008 3944 ieinstal.exe 56 PID 3944 set thread context of 3008 3944 ieinstal.exe 56 PID 3820 set thread context of 3008 3820 cmd.exe 56 -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe - Script User-Agent 2 IoCs
description flow ioc HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3944 ieinstal.exe 3944 ieinstal.exe 3944 ieinstal.exe 3944 ieinstal.exe 3944 ieinstal.exe 3944 ieinstal.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3944 ieinstal.exe Token: SeDebugPrivilege 3820 cmd.exe Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3944 ieinstal.exe 3944 ieinstal.exe 3944 ieinstal.exe 3944 ieinstal.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe 3820 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\Gkauepj.exe"C:\Users\Admin\AppData\Local\Temp\Gkauepj.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:3944
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Adds Run entry to start application
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:3820 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3516
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2572
-
-