Analysis
- max time kernel
79s - max time network
68s - platform
windows10_x64 - resource
win10v200430 - submitted
17/07/2020, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
Names on property deed.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Names on property deed.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Names on property deed.exe
- Size 5.2MB
- Sample200717-4m223azfv2
- SHA256 489e4ff4fe5b8ab211bb956c6518accebaf82dfcaa9db07d8e865c894a2ee446
- MD5 6299191fbb293b68a4a188209143f2cd
- SHA1 e3df021a28f2e3661e911af69a31fc390477b13a
- SHA512 e6a1a55fa72aea4538a8fe71f221bdb58236592cd878740a7141291e5e500db181fdb0cd9a98973d4864b62e8c18011b31b0cee6ed11153b5dbe02230a1b93aa
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1000 MSBuild.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1000 MSBuild.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 112 IoCs
description pid Process procid_target PID 2916 wrote to memory of 640 2916 Names on property deed.exe 66 PID 2916 wrote to memory of 640 2916 Names on property deed.exe 66 PID 2916 wrote to memory of 640 2916 Names on property deed.exe 66 PID 640 wrote to memory of 840 640 rundll32.exe 67 PID 640 wrote to memory of 840 640 rundll32.exe 67 PID 640 wrote to memory of 840 640 rundll32.exe 67 PID 640 wrote to memory of 840 640 rundll32.exe 67 PID 640 wrote to memory of 840 640 rundll32.exe 67 PID 640 wrote to memory of 840 640 rundll32.exe 67 PID 640 wrote to memory of 840 640 rundll32.exe 67 PID 640 wrote to memory of 840 640 rundll32.exe 67 PID 640 wrote to memory of 840 640 rundll32.exe 67 PID 640 wrote to memory of 904 640 rundll32.exe 68 PID 640 wrote to memory of 904 640 rundll32.exe 68 PID 640 wrote to memory of 904 640 rundll32.exe 68 PID 640 wrote to memory of 904 640 rundll32.exe 68 PID 640 wrote to memory of 904 640 rundll32.exe 68 PID 640 wrote to memory of 904 640 rundll32.exe 68 PID 640 wrote to memory of 904 640 rundll32.exe 68 PID 640 wrote to memory of 904 640 rundll32.exe 68 PID 640 wrote to memory of 904 640 rundll32.exe 68 PID 640 wrote to memory of 992 640 rundll32.exe 69 PID 640 wrote to memory of 992 640 rundll32.exe 69 PID 640 wrote to memory of 992 640 rundll32.exe 69 PID 640 wrote to memory of 992 640 rundll32.exe 69 PID 640 wrote to memory of 992 640 rundll32.exe 69 PID 640 wrote to memory of 992 640 rundll32.exe 69 PID 640 wrote to memory of 992 640 rundll32.exe 69 PID 640 wrote to memory of 992 640 rundll32.exe 69 PID 640 wrote to memory of 992 640 rundll32.exe 69 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 PID 640 wrote to memory of 1000 640 rundll32.exe 70 - Loads dropped DLL 1 IoCs
pid Process 640 rundll32.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 1000 MSBuild.exe 1000 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Names on property deed.exe"C:\Users\Admin\AppData\Local\Temp\Names on property deed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Spermatocyte,Michelle2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:840
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:992
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:1000
-
-