Analysis
- max time kernel
150s - max time network
120s - platform
windows7_x64 - resource
win7 - submitted
23/07/2020, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
~753875.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
~753875.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target ~753875.exe
- Size 336KB
- Sample200723-l63fmtfwfe
- SHA256 d197285f37378d669afe2da7d3c60dcb93c118acf0d059d14ca67dcd73708ed2
- MD5 77a1fa05f39ec1d2ae7cc459f0939668
- SHA1 42110c6d49abd66e84857925d5db0eb23efcdc1a
- SHA512 c3f3cff7604953a7489eccef43b842610f28635f8a26ae37d11dd3a4711307e826b5bcaa403060b26ee00ab7549be5abf2832fcbdb74b29031ad776eaf9663fc
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1508 1612 ~753875.exe 24 PID 1612 wrote to memory of 1508 1612 ~753875.exe 24 PID 1612 wrote to memory of 1508 1612 ~753875.exe 24 PID 1612 wrote to memory of 1508 1612 ~753875.exe 24 PID 1612 wrote to memory of 1508 1612 ~753875.exe 24 PID 1612 wrote to memory of 1508 1612 ~753875.exe 24 PID 1612 wrote to memory of 1508 1612 ~753875.exe 24 PID 1612 wrote to memory of 1508 1612 ~753875.exe 24 PID 1508 wrote to memory of 1628 1508 msiexec.exe 27 PID 1508 wrote to memory of 1628 1508 msiexec.exe 27 PID 1508 wrote to memory of 1628 1508 msiexec.exe 27 PID 1628 wrote to memory of 1564 1628 cmd.exe 29 PID 1628 wrote to memory of 1564 1628 cmd.exe 29 PID 1628 wrote to memory of 1564 1628 cmd.exe 29 - Deletes itself 1 IoCs
pid Process 1508 msiexec.exe - Suspicious behavior: EnumeratesProcesses 220 IoCs
pid Process 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe 1508 msiexec.exe - Blacklisted process makes network request 5 IoCs
flow pid Process 9 1508 msiexec.exe 10 1508 msiexec.exe 11 1508 msiexec.exe 12 1508 msiexec.exe 14 1508 msiexec.exe - Loads dropped DLL 1 IoCs
pid Process 1508 msiexec.exe - Modifies registry class 2 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{0C1A31B0-92D4-B0E4-95FC-0941DEE12D86}\ = abe5df906da021c613138eafc9b8d01c356f1628e5e0abab8d2ff1707e12cfe0e936ad0e013ef24969303e6a7a3e56ae9b3d573973b427bb81ad00595bd5491fcc5a4d934c3bfb8504bf359a30bb5d48decd1f92e3e5b54bef7efa977e72ba346fbc9c362fbf419f720fb3acbbbc9edbae7f4f233654b3dd34657dfc400d7dad949fa8bbcf11b3241e0e282a5ad973f8928eaee5de4eef7f530a292f55c41c8b949fa8bbcf11b3241a04263f4ec468ea909bb4aac84eef7f1919723345d133ea898fb5a4bc2bf47f081b2f7113847be29b8ab4a4d047f57d1919723f53db33ea898fb5a4bc2b9c msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{0C1A31B0-92D4-B0E4-95FC-0941DEE12D86} msiexec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\~753875.exe"C:\Users\Admin\AppData\Local\Temp\~753875.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\windows\system32\msiexec.exeC:\windows\system32\msiexec.exe /i uqllzl.msi2⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Loads dropped DLL
- Modifies registry class
PID:1508 -
C:\windows\system32\cmd.execmd /c chcp3⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\chcp.comchcp4⤵PID:1564
-
-
-