Analysis
-
max time kernel
129s -
max time network
154s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
14-07-2020 13:31
Static task
static1
Behavioral task
behavioral1
Sample
plcfeVYdiIOV5jX.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
plcfeVYdiIOV5jX.exe
Resource
win10
General
-
Target
plcfeVYdiIOV5jX.exe
-
Size
992KB
-
MD5
d1a32e0c76d6987491bb615870cff8e8
-
SHA1
4b1d30b1216c65f3bdf893127c8e293f4e33bcec
-
SHA256
8435871f09b1ba4c78f547c3bda0c509e426601221f60b455f6b6cb9d8a2f1ce
-
SHA512
659525820f88d841dd5f0a32ccf30d3bb6f5964e92f16ccdb2e87fe1a1126af21f8ce78abd87bb2110854b98cd9d6beedf0df3e78da8b506fe9068a86d2fdd5f
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
plcfeVYdiIOV5jX.exeplcfeVYdiIOV5jX.exedescription pid Process Token: SeDebugPrivilege 376 plcfeVYdiIOV5jX.exe Token: SeDebugPrivilege 648 plcfeVYdiIOV5jX.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
plcfeVYdiIOV5jX.exedescription pid Process procid_target PID 376 set thread context of 648 376 plcfeVYdiIOV5jX.exe 29 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
plcfeVYdiIOV5jX.exepid Process 648 plcfeVYdiIOV5jX.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
plcfeVYdiIOV5jX.exedescription pid Process procid_target PID 376 wrote to memory of 1888 376 plcfeVYdiIOV5jX.exe 26 PID 376 wrote to memory of 1888 376 plcfeVYdiIOV5jX.exe 26 PID 376 wrote to memory of 1888 376 plcfeVYdiIOV5jX.exe 26 PID 376 wrote to memory of 1888 376 plcfeVYdiIOV5jX.exe 26 PID 376 wrote to memory of 324 376 plcfeVYdiIOV5jX.exe 28 PID 376 wrote to memory of 324 376 plcfeVYdiIOV5jX.exe 28 PID 376 wrote to memory of 324 376 plcfeVYdiIOV5jX.exe 28 PID 376 wrote to memory of 324 376 plcfeVYdiIOV5jX.exe 28 PID 376 wrote to memory of 648 376 plcfeVYdiIOV5jX.exe 29 PID 376 wrote to memory of 648 376 plcfeVYdiIOV5jX.exe 29 PID 376 wrote to memory of 648 376 plcfeVYdiIOV5jX.exe 29 PID 376 wrote to memory of 648 376 plcfeVYdiIOV5jX.exe 29 PID 376 wrote to memory of 648 376 plcfeVYdiIOV5jX.exe 29 PID 376 wrote to memory of 648 376 plcfeVYdiIOV5jX.exe 29 PID 376 wrote to memory of 648 376 plcfeVYdiIOV5jX.exe 29 PID 376 wrote to memory of 648 376 plcfeVYdiIOV5jX.exe 29 PID 376 wrote to memory of 648 376 plcfeVYdiIOV5jX.exe 29 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
plcfeVYdiIOV5jX.exeplcfeVYdiIOV5jX.exepid Process 376 plcfeVYdiIOV5jX.exe 648 plcfeVYdiIOV5jX.exe 648 plcfeVYdiIOV5jX.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
plcfeVYdiIOV5jX.exepid Process 648 plcfeVYdiIOV5jX.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
Processes
-
C:\Users\Admin\AppData\Local\Temp\plcfeVYdiIOV5jX.exe"C:\Users\Admin\AppData\Local\Temp\plcfeVYdiIOV5jX.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:376 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fHCIaxvalqwwiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA8A.tmp"2⤵
- Creates scheduled task(s)
PID:1888
-
-
C:\Users\Admin\AppData\Local\Temp\plcfeVYdiIOV5jX.exe"{path}"2⤵PID:324
-
-
C:\Users\Admin\AppData\Local\Temp\plcfeVYdiIOV5jX.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: AddClipboardFormatListener
PID:648
-