Analysis
- max time kernel
145s - max time network
131s - platform
windows10_x64 - resource
win10 - submitted
31/07/2020, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation voucher.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target Confirmation voucher.exe
- Size 1.1MB
- Sample200731-1rwpysy2fj
- SHA256 0cd1ca47d2e04de65562e1ba4d8ce4545ee486999f8f0eb7adc880c7fb7fc9b8
- MD5 7c239ebd95edce558af5ab4ba444a20e
- SHA1 72b95da770016af3be66101db42c191d60685d7f
- SHA512 bf4ad36a62ef6583dc82674767fcadffa23d5667d664e08c36cc3e05a3368ac269463dfd446be5f00db07e2918c8705190398a97a4b538ab4c61705262d5542d
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1692 okxjgnm.pif 628 RegSvcs.exe 552 RegSvcs.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 628 RegSvcs.exe Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeDebugPrivilege 860 cmstp.exe Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 628 RegSvcs.exe 628 RegSvcs.exe 628 RegSvcs.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Tid-hdx6p\ujop_rp8yvy4dbt.exe cmstp.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmstp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZB_LG8L0VF = "C:\\Program Files (x86)\\Tid-hdx6p\\ujop_rp8yvy4dbt.exe" cmstp.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3020 wrote to memory of 1692 3020 Confirmation voucher.exe 67 PID 3020 wrote to memory of 1692 3020 Confirmation voucher.exe 67 PID 3020 wrote to memory of 1692 3020 Confirmation voucher.exe 67 PID 1692 wrote to memory of 552 1692 okxjgnm.pif 69 PID 1692 wrote to memory of 552 1692 okxjgnm.pif 69 PID 1692 wrote to memory of 552 1692 okxjgnm.pif 69 PID 1692 wrote to memory of 628 1692 okxjgnm.pif 70 PID 1692 wrote to memory of 628 1692 okxjgnm.pif 70 PID 1692 wrote to memory of 628 1692 okxjgnm.pif 70 PID 1692 wrote to memory of 628 1692 okxjgnm.pif 70 PID 1692 wrote to memory of 628 1692 okxjgnm.pif 70 PID 1692 wrote to memory of 628 1692 okxjgnm.pif 70 PID 3000 wrote to memory of 860 3000 Explorer.EXE 71 PID 3000 wrote to memory of 860 3000 Explorer.EXE 71 PID 3000 wrote to memory of 860 3000 Explorer.EXE 71 PID 860 wrote to memory of 472 860 cmstp.exe 72 PID 860 wrote to memory of 472 860 cmstp.exe 72 PID 860 wrote to memory of 472 860 cmstp.exe 72 PID 860 wrote to memory of 3904 860 cmstp.exe 80 PID 860 wrote to memory of 3904 860 cmstp.exe 80 PID 860 wrote to memory of 3904 860 cmstp.exe 80 PID 860 wrote to memory of 3828 860 cmstp.exe 82 PID 860 wrote to memory of 3828 860 cmstp.exe 82 PID 860 wrote to memory of 3828 860 cmstp.exe 82 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1692 set thread context of 628 1692 okxjgnm.pif 70 PID 628 set thread context of 3000 628 RegSvcs.exe 56 PID 860 set thread context of 3000 860 cmstp.exe 56 - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 628 RegSvcs.exe 628 RegSvcs.exe 628 RegSvcs.exe 628 RegSvcs.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe - Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/628-5-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/628-5-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/628-6-0x000000000041E300-mapping.dmp formbook behavioral2/memory/860-11-0x0000000000000000-mapping.dmp formbook -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Confirmation voucher.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation voucher.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Roaming\52828230\okxjgnm.pif"C:\Users\Admin\AppData\Roaming\52828230\okxjgnm.pif" xllpdbhw.ifs3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
PID:552
-
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:628
-
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
PID:860 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵PID:472
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3904
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3828
-
-