Analysis
- max time kernel
147s - max time network
132s - platform
windows10_x64 - resource
win10 - submitted
23/07/2020, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
Specification Requirement.bat.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Specification Requirement.bat.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Specification Requirement.bat.exe
- Size 886KB
- Sample200723-2bn39pfk7x
- SHA256 8dceaa57045b4d03ea1f58bb2c82c4d4887dd74ca78bc114c1bc7bdf937e680d
- MD5 5c15297803f33fc6a66dc16bd1110dcf
- SHA1 ab52585287686e34a035800732743140901a6f4e
- SHA512 ae65fd0050017e66f53a7193666c5d72a061e0452af13dec2911d3d8431ea5dbe979d8712d595d602dfe925e45e3b2bd88fb7b68f02cbaf445a608c20255b8bc
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3544 Specification Requirement.bat.exe 3028 Specification Requirement.bat.exe 3028 Specification Requirement.bat.exe 3028 Specification Requirement.bat.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3028 Specification Requirement.bat.exe Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeDebugPrivilege 3968 control.exe Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2972 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3544 Specification Requirement.bat.exe 3544 Specification Requirement.bat.exe 3028 Specification Requirement.bat.exe 3028 Specification Requirement.bat.exe 3028 Specification Requirement.bat.exe 3028 Specification Requirement.bat.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe 3968 control.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3544 wrote to memory of 3028 3544 Specification Requirement.bat.exe 67 PID 3544 wrote to memory of 3028 3544 Specification Requirement.bat.exe 67 PID 3544 wrote to memory of 3028 3544 Specification Requirement.bat.exe 67 PID 2972 wrote to memory of 3968 2972 Explorer.EXE 73 PID 2972 wrote to memory of 3968 2972 Explorer.EXE 73 PID 2972 wrote to memory of 3968 2972 Explorer.EXE 73 PID 3968 wrote to memory of 3844 3968 control.exe 74 PID 3968 wrote to memory of 3844 3968 control.exe 74 PID 3968 wrote to memory of 3844 3968 control.exe 74 PID 3968 wrote to memory of 652 3968 control.exe 82 PID 3968 wrote to memory of 652 3968 control.exe 82 PID 3968 wrote to memory of 652 3968 control.exe 82 PID 3968 wrote to memory of 852 3968 control.exe 84 PID 3968 wrote to memory of 852 3968 control.exe 84 PID 3968 wrote to memory of 852 3968 control.exe 84 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Expxxv4s\nzbylrlgjq8.exe control.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IHFTB0UXKT = "C:\\Program Files (x86)\\Expxxv4s\\nzbylrlgjq8.exe" control.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run control.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3544 set thread context of 3028 3544 Specification Requirement.bat.exe 67 PID 3028 set thread context of 2972 3028 Specification Requirement.bat.exe 56 PID 3968 set thread context of 2972 3968 control.exe 56 - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:3028
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3932
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3864
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3016
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:4016
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:4068
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:3968 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"3⤵PID:3844
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:652
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:852
-
-