Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10 - submitted
04/08/2020, 13:37
Static task
static1
Behavioral task
behavioral1
Sample
IMAGE-04082020.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target IMAGE-04082020.exe
- Size 425KB
- Sample200804-3bncxbvjdn
- SHA256 1f3a78fa36bc0741a38e82e73ea0a214ef806c0d968c70b99aa71c73864be656
- MD5 451347fc2142b7f84e5cf3e2bca618d8
- SHA1 d2e3539033e217faa8fa123d2f444eb47ce9c476
- SHA512 982a17cf8e7a3a3dd6c658ef031d942eea735b857d2d54a163871bacf7d8854fcda607248437be6697a78d57e0b33695a71ffbf91173912f8a1e051b5cb69171
- MD5 SHA1 SHA512
Malware Config
Signatures
- System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer explorer.exe - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YV1DANU8R = "C:\\Program Files (x86)\\Hr4nh\\wbcdwmfqxc.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3888 wrote to memory of 3876 3888 IMAGE-04082020.exe 67 PID 3888 wrote to memory of 3876 3888 IMAGE-04082020.exe 67 PID 3888 wrote to memory of 3876 3888 IMAGE-04082020.exe 67 PID 3888 wrote to memory of 3876 3888 IMAGE-04082020.exe 67 PID 3888 wrote to memory of 3876 3888 IMAGE-04082020.exe 67 PID 3888 wrote to memory of 3876 3888 IMAGE-04082020.exe 67 PID 2976 wrote to memory of 3824 2976 Explorer.EXE 68 PID 2976 wrote to memory of 3824 2976 Explorer.EXE 68 PID 2976 wrote to memory of 3824 2976 Explorer.EXE 68 PID 3824 wrote to memory of 3916 3824 explorer.exe 69 PID 3824 wrote to memory of 3916 3824 explorer.exe 69 PID 3824 wrote to memory of 3916 3824 explorer.exe 69 PID 3824 wrote to memory of 1196 3824 explorer.exe 77 PID 3824 wrote to memory of 1196 3824 explorer.exe 77 PID 3824 wrote to memory of 1196 3824 explorer.exe 77 PID 3824 wrote to memory of 1384 3824 explorer.exe 79 PID 3824 wrote to memory of 1384 3824 explorer.exe 79 PID 3824 wrote to memory of 1384 3824 explorer.exe 79 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3888 set thread context of 3876 3888 IMAGE-04082020.exe 67 PID 3876 set thread context of 2976 3876 IMAGE-04082020.exe 56 PID 3824 set thread context of 2976 3824 explorer.exe 56 - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3876 IMAGE-04082020.exe 3876 IMAGE-04082020.exe 3876 IMAGE-04082020.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe - Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/3876-0-0x0000000000400000-0x0000000000428000-memory.dmp formbook behavioral2/memory/3876-0-0x0000000000400000-0x0000000000428000-memory.dmp formbook behavioral2/memory/3876-1-0x000000000041CA50-mapping.dmp formbook behavioral2/memory/3824-2-0x0000000000000000-mapping.dmp formbook - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3888 IMAGE-04082020.exe Token: SeDebugPrivilege 3876 IMAGE-04082020.exe Token: SeDebugPrivilege 3824 explorer.exe Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3888 IMAGE-04082020.exe 3888 IMAGE-04082020.exe 3876 IMAGE-04082020.exe 3876 IMAGE-04082020.exe 3876 IMAGE-04082020.exe 3876 IMAGE-04082020.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe 3824 explorer.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Hr4nh\wbcdwmfqxc.exe explorer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\IMAGE-04082020.exe"C:\Users\Admin\AppData\Local\Temp\IMAGE-04082020.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\IMAGE-04082020.exe"C:\Users\Admin\AppData\Local\Temp\IMAGE-04082020.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3876
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- System policy modification
- Adds policy Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
PID:3824 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMAGE-04082020.exe"3⤵PID:3916
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1196
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1384
-
-