220d9dee8512451f79c4ea016e9ed065ca3f378f3f1b29531cee3c686a100cce

Analysis

max time kernel
69s
max time network
133s
platform
windows10_x64
resource
win10
submitted
18/07/2020, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CI_PL.exe
Size 1000KB
Sample200718-j97dlmr84x
SHA256 220d9dee8512451f79c4ea016e9ed065ca3f378f3f1b29531cee3c686a100cce
MD5 3e9ad736204d17eb3df39faf37ffe849
SHA1 c9e131f2128aaf36f496c57826e51acac35277ca
SHA512 bca22c0dfe4b1c51296e71126e7fe6ff1b7c8883caa06906430ad620aa0b00f36d6f797a5dba79b9aa7222f69bdc7ba92eb9a24cd479df9163f053944001c0f7
MD5 SHA1 SHA512

Score

7^/10

persistence spyware

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3384	3100	CI_PL.exe	67
PID 3100 wrote to memory of 3384	3100	CI_PL.exe	67
PID 3100 wrote to memory of 3384	3100	CI_PL.exe	67
PID 3100 wrote to memory of 3384	3100	CI_PL.exe	67
PID 3100 wrote to memory of 3384	3100	CI_PL.exe	67

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3100 set thread context of 3384	3100	CI_PL.exe	67

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad96-6.dat	js

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Svjk = "C:\\Users\\Admin\\AppData\\Local\\Svjk\\Svjk.hta"	CI_PL.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3384	ieinstal.exe

Loads dropped DLL 6 IoCs

pid	Process
3384	ieinstal.exe
3384	ieinstal.exe
3384	ieinstal.exe
3384	ieinstal.exe
3384	ieinstal.exe
3384	ieinstal.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\CI_PL.exe
"C:\Users\Admin\AppData\Local\Temp\CI_PL.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run key to start application
PID:3100
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Loads dropped DLL
  PID:3384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3384-0-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3384-2-0x0000000000400000-0x0000000000554000-memory.dmp