Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7 -
submitted
31-07-2020 10:22
Static task
static1
Behavioral task
behavioral1
Sample
Versanddetails.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
Versanddetails.exe
-
Size
596KB
-
MD5
269a05d36d071c206dc87187d6136352
-
SHA1
85f8c093f487db02ebbbda53d0893be9bdbc0ace
-
SHA256
b774ad4c9780bdb6e4fec9dbd688f1ac6d0ee75e9771c64de99e1f5152e0b385
-
SHA512
2449cc3e98eb46ffb373552fe1ca7cca4fea9628482e0f3214a2ef19a97240b184eca1191607e6406d810238ef8a0a29030867bec0baf44a7c480d485d661ebc
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Versanddetails.exeRegAsm.exedescription pid process target process PID 1312 wrote to memory of 1396 1312 Versanddetails.exe RegAsm.exe PID 1312 wrote to memory of 1396 1312 Versanddetails.exe RegAsm.exe PID 1312 wrote to memory of 1396 1312 Versanddetails.exe RegAsm.exe PID 1312 wrote to memory of 1396 1312 Versanddetails.exe RegAsm.exe PID 1312 wrote to memory of 1396 1312 Versanddetails.exe RegAsm.exe PID 1312 wrote to memory of 1396 1312 Versanddetails.exe RegAsm.exe PID 1312 wrote to memory of 1396 1312 Versanddetails.exe RegAsm.exe PID 1312 wrote to memory of 1396 1312 Versanddetails.exe RegAsm.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1808 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe PID 1396 wrote to memory of 1844 1396 RegAsm.exe vbc.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Versanddetails.exepid process 1312 Versanddetails.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Versanddetails.exeRegAsm.exedescription pid process target process PID 1312 set thread context of 1396 1312 Versanddetails.exe RegAsm.exe PID 1396 set thread context of 1808 1396 RegAsm.exe vbc.exe PID 1396 set thread context of 1844 1396 RegAsm.exe vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1396 RegAsm.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 whatismyipaddress.com 5 whatismyipaddress.com -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious behavior: EnumeratesProcesses 1090 IoCs
Processes:
RegAsm.exepid process 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe 1396 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 1396 RegAsm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Versanddetails.exe"C:\Users\Admin\AppData\Local\Temp\Versanddetails.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txt
-
memory/1396-0-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1396-1-0x0000000000480C5E-mapping.dmp
-
memory/1396-2-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1396-3-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1808-5-0x0000000000411654-mapping.dmp
-
memory/1808-4-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1808-6-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1844-7-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1844-8-0x0000000000442628-mapping.dmp
-
memory/1844-9-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB