Analysis
- max time kernel
149s - max time network
135s - platform
windows10_x64 - resource
win10 - submitted
28/07/2020, 18:54
Static task
static1
Behavioral task
behavioral1
Sample
009284746651_Doc.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
009284746651_Doc.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 009284746651_Doc.exe
- Size 354KB
- Sample200728-2lnqawk522
- SHA256 5853115efe30713520475cbe15d78cd6ed2e79483068463beacd41d0ebdce7c5
- MD5 b973f0a583fc2154869389bf49489656
- SHA1 3208c659f8749d48d99b481818a90c9f141d0a3d
- SHA512 9bfc5a1d1821763bb90c2825d60b134d5b343d99ab7cf618bac59391d94d39bb4a1f3ab0454de819557b352b900c7cf7d589095c6095baf2ce0103f02a105da9
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3892 009284746651_Doc.exe Token: SeDebugPrivilege 3840 netsh.exe Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3892 set thread context of 3000 3892 009284746651_Doc.exe 56 PID 3840 set thread context of 3000 3840 netsh.exe 56 - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3840 3000 Explorer.EXE 67 PID 3000 wrote to memory of 3840 3000 Explorer.EXE 67 PID 3000 wrote to memory of 3840 3000 Explorer.EXE 67 PID 3840 wrote to memory of 3864 3840 netsh.exe 68 PID 3840 wrote to memory of 3864 3840 netsh.exe 68 PID 3840 wrote to memory of 3864 3840 netsh.exe 68 PID 3840 wrote to memory of 608 3840 netsh.exe 70 PID 3840 wrote to memory of 608 3840 netsh.exe 70 PID 3840 wrote to memory of 608 3840 netsh.exe 70 PID 3840 wrote to memory of 1620 3840 netsh.exe 72 PID 3840 wrote to memory of 1620 3840 netsh.exe 72 PID 3840 wrote to memory of 1620 3840 netsh.exe 72 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 3892 009284746651_Doc.exe 3892 009284746651_Doc.exe 3892 009284746651_Doc.exe 3892 009284746651_Doc.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3892 009284746651_Doc.exe 3892 009284746651_Doc.exe 3892 009284746651_Doc.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe 3840 netsh.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run netsh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UFI8A = "C:\\Program Files (x86)\\Swxl\\lxy_dr4yze.exe" netsh.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Swxl\lxy_dr4yze.exe netsh.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\009284746651_Doc.exe"C:\Users\Admin\AppData\Local\Temp\009284746651_Doc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3892
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Adds Run key to start application
- Modifies Internet Explorer settings
- Drops file in Program Files directory
PID:3840 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\009284746651_Doc.exe"3⤵PID:3864
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:608
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1620
-
-