Overview

overview

8

Static

static

~753875.exe

windows7_x64

8

~753875.exe

windows10_x64

8

Analysis

  • max time kernel
    149s
  • max time network
    114s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    23/07/2020, 17:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ~753875.exe
  • Size 336KB
  • Sample200723-l63fmtfwfe
  • SHA256 d197285f37378d669afe2da7d3c60dcb93c118acf0d059d14ca67dcd73708ed2
  • MD5 SHA1 SHA512
Score
8/10
spyware

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Loads dropped DLL 2 IoCs
  • Runs net.exe
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Discovers systems in the same network 1 TTPs 2 IoCs
    discovery
  • Modifies registry class 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious use of WriteProcessMemory 25 IoCs
  • Deletes itself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 214 IoCs
  • Blacklisted process makes network request 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\~753875.exe
    "C:\Users\Admin\AppData\Local\Temp\~753875.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\windows\system32\msiexec.exe
      C:\windows\system32\msiexec.exe /i ekozdh.msi
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      • Deletes itself
      • Suspicious behavior: EnumeratesProcesses
      • Blacklisted process makes network request
      PID:2728
      • C:\windows\system32\cmd.exe
        cmd /c chcp
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Windows\system32\chcp.com
          chcp
          4⤵
            PID:3984
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1908
        • C:\windows\system32\ipconfig.exe
          ipconfig /all
          3⤵
          • Gathers network information
          PID:1872
        • C:\windows\system32\systeminfo.exe
          systeminfo
          3⤵
          • Gathers system information
          PID:2968
        • C:\windows\system32\net.exe
          net config workstation
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 config workstation
            4⤵
              PID:668
          • C:\windows\system32\nltest.exe
            nltest /domain_trusts
            3⤵
              PID:580
            • C:\windows\system32\nltest.exe
              nltest /domain_trusts /all_trusts
              3⤵
                PID:2164
              • C:\windows\system32\net.exe
                net view /all /domain
                3⤵
                • Discovers systems in the same network
                PID:3456
              • C:\windows\system32\net.exe
                net view /all
                3⤵
                • Discovers systems in the same network
                PID:2388

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                memory/2728-3-0x0000000180000000-0x000000018006D000-memory.dmp
                Download

                memory/2728-10-0x000001E44E920000-0x000001E44EAED000-memory.dmp
                Download

                memory/2728-1-0x000001E44C230000-0x000001E44C2D5000-memory.dmp
                Download