Analysis
- max time kernel
145s - max time network
132s - platform
windows10_x64 - resource
win10v200430 - submitted
19/07/2020, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
grabbot_0.1.5.3.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
grabbot_0.1.5.3.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target grabbot_0.1.5.3.vir.exe
- Size 280KB
- Sample200719-v38mlqlfrs
- SHA256 6d9e623ecfe0a68e9240fb25a1b25d57b4c42dcf5dfcf0a73e414a1347046204
- MD5 ff4f8502939ff5e71705d7354fc8520e
- SHA1 2e32fa6b3371b9efe82fccb58eb661162b0b4790
- SHA512 dcb58d34eac4a80e4fc7c5c4f89c0ddfc941a3953863c8569ff662ead616bd6938d0fab1f5703f178a0dc8c2b64cd6fa30ecb497c4c220dfc2de34f55ac3c3fe
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2116 set thread context of 2672 2116 grabbot_0.1.5.3.vir.exe 68 - Deletes itself 1 IoCs
pid Process 2988 Explorer.EXE - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\{38E2F5B8-FE40-AE00-9000-114FB4F489} = "\"C:\\Users\\Admin\\AppData\\Roaming\\{38E2F5B8-FE40-AE00-9000-114FB4F489}\\chinstyafg.exe\"" Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2116 grabbot_0.1.5.3.vir.exe 2116 grabbot_0.1.5.3.vir.exe 2116 grabbot_0.1.5.3.vir.exe 2116 grabbot_0.1.5.3.vir.exe 2116 grabbot_0.1.5.3.vir.exe 2116 grabbot_0.1.5.3.vir.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe 2672 svchost.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2116 grabbot_0.1.5.3.vir.exe Token: SeSecurityPrivilege 2116 grabbot_0.1.5.3.vir.exe Token: SeSecurityPrivilege 2116 grabbot_0.1.5.3.vir.exe Token: SeSecurityPrivilege 2116 grabbot_0.1.5.3.vir.exe Token: SeSecurityPrivilege 2672 svchost.exe Token: SeSecurityPrivilege 2672 svchost.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2988 2116 grabbot_0.1.5.3.vir.exe 55 PID 2116 wrote to memory of 2988 2116 grabbot_0.1.5.3.vir.exe 55 PID 2116 wrote to memory of 2988 2116 grabbot_0.1.5.3.vir.exe 55 PID 2116 wrote to memory of 2672 2116 grabbot_0.1.5.3.vir.exe 68 PID 2116 wrote to memory of 2672 2116 grabbot_0.1.5.3.vir.exe 68 PID 2116 wrote to memory of 2672 2116 grabbot_0.1.5.3.vir.exe 68 PID 2116 wrote to memory of 2672 2116 grabbot_0.1.5.3.vir.exe 68 PID 2116 wrote to memory of 2672 2116 grabbot_0.1.5.3.vir.exe 68
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Deletes itself
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.5.3.vir.exe"C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.5.3.vir.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-