Analysis
- max time kernel
85s - max time network
87s - platform
windows10_x64 - resource
win10v200722 - submitted
31/07/2020, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
gunzipped.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target gunzipped.exe
- Size 393KB
- Sample200731-18saxew276
- SHA256 ad1a08a8f15ac0b57f23c950aa111f54075bdd708c91fc47899947808ae6e086
- MD5 21571073d575e965c14c8315ccca654e
- SHA1 f6f4c38a6fabf7971292ff2d97c0329a976ea25d
- SHA512 11a3b79986517b2a2d34cfc6f95e02056a570d0593ae442affaf985ea4a4e244e5163d74d249434aec46231120bd69ae8beb255e7a9806369c07d508b0a25748
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 3888 gunzipped.exe Token: SeImpersonatePrivilege 960 gunzipped.exe Token: SeTcbPrivilege 960 gunzipped.exe Token: SeChangeNotifyPrivilege 960 gunzipped.exe Token: SeCreateTokenPrivilege 960 gunzipped.exe Token: SeBackupPrivilege 960 gunzipped.exe Token: SeRestorePrivilege 960 gunzipped.exe Token: SeIncreaseQuotaPrivilege 960 gunzipped.exe Token: SeAssignPrimaryTokenPrivilege 960 gunzipped.exe Token: SeImpersonatePrivilege 960 gunzipped.exe Token: SeTcbPrivilege 960 gunzipped.exe Token: SeChangeNotifyPrivilege 960 gunzipped.exe Token: SeCreateTokenPrivilege 960 gunzipped.exe Token: SeBackupPrivilege 960 gunzipped.exe Token: SeRestorePrivilege 960 gunzipped.exe Token: SeIncreaseQuotaPrivilege 960 gunzipped.exe Token: SeAssignPrimaryTokenPrivilege 960 gunzipped.exe Token: SeImpersonatePrivilege 960 gunzipped.exe Token: SeTcbPrivilege 960 gunzipped.exe Token: SeChangeNotifyPrivilege 960 gunzipped.exe Token: SeCreateTokenPrivilege 960 gunzipped.exe Token: SeBackupPrivilege 960 gunzipped.exe Token: SeRestorePrivilege 960 gunzipped.exe Token: SeIncreaseQuotaPrivilege 960 gunzipped.exe Token: SeAssignPrimaryTokenPrivilege 960 gunzipped.exe Token: SeImpersonatePrivilege 960 gunzipped.exe Token: SeTcbPrivilege 960 gunzipped.exe Token: SeChangeNotifyPrivilege 960 gunzipped.exe Token: SeCreateTokenPrivilege 960 gunzipped.exe Token: SeBackupPrivilege 960 gunzipped.exe Token: SeRestorePrivilege 960 gunzipped.exe Token: SeIncreaseQuotaPrivilege 960 gunzipped.exe Token: SeAssignPrimaryTokenPrivilege 960 gunzipped.exe Token: SeImpersonatePrivilege 960 gunzipped.exe Token: SeTcbPrivilege 960 gunzipped.exe Token: SeChangeNotifyPrivilege 960 gunzipped.exe Token: SeCreateTokenPrivilege 960 gunzipped.exe Token: SeBackupPrivilege 960 gunzipped.exe Token: SeRestorePrivilege 960 gunzipped.exe Token: SeIncreaseQuotaPrivilege 960 gunzipped.exe Token: SeAssignPrimaryTokenPrivilege 960 gunzipped.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3888 gunzipped.exe 3888 gunzipped.exe 3888 gunzipped.exe 3888 gunzipped.exe 3888 gunzipped.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3888 wrote to memory of 696 3888 gunzipped.exe 68 PID 3888 wrote to memory of 696 3888 gunzipped.exe 68 PID 3888 wrote to memory of 696 3888 gunzipped.exe 68 PID 3888 wrote to memory of 960 3888 gunzipped.exe 69 PID 3888 wrote to memory of 960 3888 gunzipped.exe 69 PID 3888 wrote to memory of 960 3888 gunzipped.exe 69 PID 3888 wrote to memory of 960 3888 gunzipped.exe 69 PID 3888 wrote to memory of 960 3888 gunzipped.exe 69 PID 3888 wrote to memory of 960 3888 gunzipped.exe 69 PID 3888 wrote to memory of 960 3888 gunzipped.exe 69 PID 3888 wrote to memory of 960 3888 gunzipped.exe 69 PID 960 wrote to memory of 1232 960 gunzipped.exe 70 PID 960 wrote to memory of 1232 960 gunzipped.exe 70 PID 960 wrote to memory of 1232 960 gunzipped.exe 70 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3888 set thread context of 960 3888 gunzipped.exe 69 - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"{path}"2⤵PID:696
-
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\124968.bat" "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe" "3⤵PID:1232
-
-