Analysis
- max time kernel
147s - max time network
154s - platform
windows7_x64 - resource
win7 - submitted
25/07/2020, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
24-7.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
24-7.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 24-7.exe
- Size 430KB
- Sample200725-twebd3bq22
- SHA256 967360ebfc55336f03edccc32869b0e6b65c17e66fcdac083d4bcc185b852c0d
- MD5 bec411e2423af5db62afa0495631d54c
- SHA1 a993c88fe8d0affa3fe35162844735fb5f44d7d9
- SHA512 04f189a2f0f2955e252128c3374402064307e742d8e7ba5b762eb9f8171dda08d84f709c85b1d6f0c72abfab1c3cd41ca9f4502328313c3722d857c9bfc0ac47
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1016 RegAsm.exe Token: SeDebugPrivilege 788 raserver.exe - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Oa2d\user2d0.exe raserver.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 1492 24-7.exe 1016 RegAsm.exe 1016 RegAsm.exe 1016 RegAsm.exe 1016 RegAsm.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe - Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1016 RegAsm.exe 1016 RegAsm.exe 1016 RegAsm.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe 788 raserver.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run raserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Z2KDMLUH5L = "C:\\Program Files (x86)\\Oa2d\\user2d0.exe" raserver.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1016 1492 24-7.exe 24 PID 1492 wrote to memory of 1016 1492 24-7.exe 24 PID 1492 wrote to memory of 1016 1492 24-7.exe 24 PID 1492 wrote to memory of 1016 1492 24-7.exe 24 PID 1492 wrote to memory of 1016 1492 24-7.exe 24 PID 1492 wrote to memory of 1016 1492 24-7.exe 24 PID 1492 wrote to memory of 1016 1492 24-7.exe 24 PID 1492 wrote to memory of 1016 1492 24-7.exe 24 PID 1228 wrote to memory of 788 1228 Explorer.EXE 25 PID 1228 wrote to memory of 788 1228 Explorer.EXE 25 PID 1228 wrote to memory of 788 1228 Explorer.EXE 25 PID 1228 wrote to memory of 788 1228 Explorer.EXE 25 PID 788 wrote to memory of 532 788 raserver.exe 26 PID 788 wrote to memory of 532 788 raserver.exe 26 PID 788 wrote to memory of 532 788 raserver.exe 26 PID 788 wrote to memory of 532 788 raserver.exe 26 PID 788 wrote to memory of 1556 788 raserver.exe 31 PID 788 wrote to memory of 1556 788 raserver.exe 31 PID 788 wrote to memory of 1556 788 raserver.exe 31 PID 788 wrote to memory of 1556 788 raserver.exe 31 PID 788 wrote to memory of 1556 788 raserver.exe 31 - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1492 set thread context of 1016 1492 24-7.exe 24 PID 1016 set thread context of 1228 1016 RegAsm.exe 20 PID 1016 set thread context of 1228 1016 RegAsm.exe 20 PID 788 set thread context of 1228 788 raserver.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\24-7.exe"C:\Users\Admin\AppData\Local\Temp\24-7.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1492 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1016
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:788 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:532
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1556
-
-