Analysis
-
max time kernel
149s -
max time network
115s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 13:40
Static task
static1
Behavioral task
behavioral1
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
STATEMENT OF ACCOUNT.exe
-
Size
332KB
-
MD5
ee68d3b0f702077810bddec50179f75d
-
SHA1
e84957da433e6df765486f71391edf69f882f50a
-
SHA256
ee3971f3a905a7bd6126d3d02e0ecaa71bbe41136d3faa0680eec42a4cf20af9
-
SHA512
957eeeef26c139874fc7983078872b491f534ccc447f98d920ac43d11df7b36ffd3cfa1519fb178d6d103a04237b31f4cd5523cedbea778095a93fc0343cebe4
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1316 Explorer.EXE 1316 Explorer.EXE 1316 Explorer.EXE 1316 Explorer.EXE 1316 Explorer.EXE -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe STATEMENT OF ACCOUNT.exe -
description ioc Process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1500 STATEMENT OF ACCOUNT.exe 644 RegAsm.exe 644 RegAsm.exe 644 RegAsm.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1500 set thread context of 644 1500 STATEMENT OF ACCOUNT.exe 24 PID 644 set thread context of 1316 644 RegAsm.exe 20 PID 1612 set thread context of 1316 1612 cmstp.exe 20 -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 644 RegAsm.exe 644 RegAsm.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe 1612 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 644 RegAsm.exe Token: SeDebugPrivilege 1612 cmstp.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1316 Explorer.EXE 1316 Explorer.EXE 1316 Explorer.EXE 1316 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Nopg\gdiohlxv.exe cmstp.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cmstp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YNE8IXJ0ANY = "C:\\Program Files (x86)\\Nopg\\gdiohlxv.exe" cmstp.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1500 wrote to memory of 644 1500 STATEMENT OF ACCOUNT.exe 24 PID 1500 wrote to memory of 644 1500 STATEMENT OF ACCOUNT.exe 24 PID 1500 wrote to memory of 644 1500 STATEMENT OF ACCOUNT.exe 24 PID 1500 wrote to memory of 644 1500 STATEMENT OF ACCOUNT.exe 24 PID 1500 wrote to memory of 644 1500 STATEMENT OF ACCOUNT.exe 24 PID 1500 wrote to memory of 644 1500 STATEMENT OF ACCOUNT.exe 24 PID 1500 wrote to memory of 644 1500 STATEMENT OF ACCOUNT.exe 24 PID 1500 wrote to memory of 644 1500 STATEMENT OF ACCOUNT.exe 24 PID 1316 wrote to memory of 1612 1316 Explorer.EXE 25 PID 1316 wrote to memory of 1612 1316 Explorer.EXE 25 PID 1316 wrote to memory of 1612 1316 Explorer.EXE 25 PID 1316 wrote to memory of 1612 1316 Explorer.EXE 25 PID 1316 wrote to memory of 1612 1316 Explorer.EXE 25 PID 1316 wrote to memory of 1612 1316 Explorer.EXE 25 PID 1316 wrote to memory of 1612 1316 Explorer.EXE 25 PID 1612 wrote to memory of 740 1612 cmstp.exe 26 PID 1612 wrote to memory of 740 1612 cmstp.exe 26 PID 1612 wrote to memory of 740 1612 cmstp.exe 26 PID 1612 wrote to memory of 740 1612 cmstp.exe 26 PID 1612 wrote to memory of 1624 1612 cmstp.exe 31 PID 1612 wrote to memory of 1624 1612 cmstp.exe 31 PID 1612 wrote to memory of 1624 1612 cmstp.exe 31 PID 1612 wrote to memory of 1624 1612 cmstp.exe 31 PID 1612 wrote to memory of 1624 1612 cmstp.exe 31 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"2⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:644
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:740
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1624
-
-