Analysis
- max time kernel
147s - max time network
142s - platform
windows10_x64 - resource
win10 - submitted
16/07/2020, 18:35
Static task
static1
Behavioral task
behavioral1
Sample
GENTECH PRODUCT INQUIRY.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
GENTECH PRODUCT INQUIRY.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target GENTECH PRODUCT INQUIRY.exe
- Size 642KB
- Sample200716-76bcpm583e
- SHA256 38d4e4ea5e9b15b4d221cc6627a7b088a54964dfe95b49173a45bc5f9177a249
- MD5 6366b461b56945be4a795ca8bd346ec3
- SHA1 d08c5c0188c8bb4e84b41bed78a805cbc0a127de
- SHA512 dc07e51c460193869514c875cdc5aaa1da59855ebaee8fae5edb44cd4acf35d37190982113fda285c0c7f95fbc5c1c854c13be42d7cad53f46360c0beddd8b82
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2948 wrote to memory of 3012 2948 GENTECH PRODUCT INQUIRY.exe 67 PID 2948 wrote to memory of 3012 2948 GENTECH PRODUCT INQUIRY.exe 67 PID 2948 wrote to memory of 3012 2948 GENTECH PRODUCT INQUIRY.exe 67 PID 2948 wrote to memory of 3012 2948 GENTECH PRODUCT INQUIRY.exe 67 PID 2948 wrote to memory of 3012 2948 GENTECH PRODUCT INQUIRY.exe 67 PID 3020 wrote to memory of 1964 3020 Explorer.EXE 68 PID 3020 wrote to memory of 1964 3020 Explorer.EXE 68 PID 3020 wrote to memory of 1964 3020 Explorer.EXE 68 PID 1964 wrote to memory of 756 1964 cmd.exe 69 PID 1964 wrote to memory of 756 1964 cmd.exe 69 PID 1964 wrote to memory of 756 1964 cmd.exe 69 PID 1964 wrote to memory of 1232 1964 cmd.exe 73 PID 1964 wrote to memory of 1232 1964 cmd.exe 73 PID 1964 wrote to memory of 1232 1964 cmd.exe 73 - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3012 ieinstal.exe 3012 ieinstal.exe 3012 ieinstal.exe 3012 ieinstal.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vsru = "C:\\Users\\Admin\\AppData\\Local\\Vsru\\Vsru.hta" GENTECH PRODUCT INQUIRY.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2948 set thread context of 3012 2948 GENTECH PRODUCT INQUIRY.exe 67 PID 3012 set thread context of 3020 3012 ieinstal.exe 56 PID 1964 set thread context of 3020 1964 cmd.exe 56 - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3012 ieinstal.exe Token: SeDebugPrivilege 1964 cmd.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3012 ieinstal.exe 3012 ieinstal.exe 3012 ieinstal.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe 1964 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\GENTECH PRODUCT INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\GENTECH PRODUCT INQUIRY.exe"2⤵
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2948 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:3012
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1964 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:756
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1232
-
-