Analysis
- max time kernel
146s - max time network
147s - platform
windows10_x64 - resource
win10v200722 - submitted
04/08/2020, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
arirrylhnq8.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target arirrylhnq8.exe
- Size 907KB
- Sample200804-4ezy4g6qqe
- SHA256 399013dde1bc2ce10effb58c3e970c8bf82d597c3b5f606a0e4ad79567515b2c
- MD5 1c3259e07070105f89c38394ae68557b
- SHA1 81a72d2374f444c9998b5bc423ec06d47078208f
- SHA512 452f8c23071cb81abed5472e75d586bab87bb0469649b2c2259ea0266c05e6392952d2d1d98524e8a21455f475a0ef5a5e12ca1f8bd3813e13f438b62a7c0437
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3952 wrote to memory of 4016 3952 arirrylhnq8.exe 66 PID 3952 wrote to memory of 4016 3952 arirrylhnq8.exe 66 PID 3952 wrote to memory of 4016 3952 arirrylhnq8.exe 66 PID 3044 wrote to memory of 3652 3044 Explorer.EXE 67 PID 3044 wrote to memory of 3652 3044 Explorer.EXE 67 PID 3044 wrote to memory of 3652 3044 Explorer.EXE 67 PID 3652 wrote to memory of 2892 3652 msdt.exe 68 PID 3652 wrote to memory of 2892 3652 msdt.exe 68 PID 3652 wrote to memory of 2892 3652 msdt.exe 68 PID 3652 wrote to memory of 3680 3652 msdt.exe 76 PID 3652 wrote to memory of 3680 3652 msdt.exe 76 PID 3652 wrote to memory of 3680 3652 msdt.exe 76 PID 3652 wrote to memory of 4076 3652 msdt.exe 78 PID 3652 wrote to memory of 4076 3652 msdt.exe 78 PID 3652 wrote to memory of 4076 3652 msdt.exe 78 PID 3044 wrote to memory of 3948 3044 Explorer.EXE 79 PID 3044 wrote to memory of 3948 3044 Explorer.EXE 79 PID 3044 wrote to memory of 3948 3044 Explorer.EXE 79 PID 3948 wrote to memory of 3820 3948 9ralglktul.exe 80 PID 3948 wrote to memory of 3820 3948 9ralglktul.exe 80 PID 3948 wrote to memory of 3820 3948 9ralglktul.exe 80 - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 4016 arirrylhnq8.exe Token: SeDebugPrivilege 3652 msdt.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeDebugPrivilege 3820 9ralglktul.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer msdt.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Zu8axqht\9ralglktul.exe msdt.exe File opened for modification C:\Program Files (x86)\Zu8axqht Explorer.EXE File created C:\Program Files (x86)\Zu8axqht\9ralglktul.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Zu8axqht\9ralglktul.exe Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3952 set thread context of 4016 3952 arirrylhnq8.exe 66 PID 4016 set thread context of 3044 4016 arirrylhnq8.exe 56 PID 3652 set thread context of 3044 3652 msdt.exe 56 PID 3948 set thread context of 3820 3948 9ralglktul.exe 80 - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3044 Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Executes dropped EXE 2 IoCs
pid Process 3948 9ralglktul.exe 3820 9ralglktul.exe - Formbook Payload 5 IoCs
resource yara_rule behavioral2/memory/4016-0-0x0000000000400000-0x0000000000427000-memory.dmp formbook behavioral2/memory/4016-0-0x0000000000400000-0x0000000000427000-memory.dmp formbook behavioral2/memory/4016-1-0x000000000041C220-mapping.dmp formbook behavioral2/memory/3652-2-0x0000000000000000-mapping.dmp formbook behavioral2/memory/3820-18-0x000000000041C220-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XD44ANAHEHK = "C:\\Program Files (x86)\\Zu8axqht\\9ralglktul.exe" msdt.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3952 arirrylhnq8.exe 3952 arirrylhnq8.exe 4016 arirrylhnq8.exe 4016 arirrylhnq8.exe 4016 arirrylhnq8.exe 4016 arirrylhnq8.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3948 9ralglktul.exe 3948 9ralglktul.exe 3652 msdt.exe 3652 msdt.exe 3820 9ralglktul.exe 3820 9ralglktul.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe - Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 3952 arirrylhnq8.exe 4016 arirrylhnq8.exe 4016 arirrylhnq8.exe 4016 arirrylhnq8.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3652 msdt.exe 3948 9ralglktul.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\arirrylhnq8.exe"C:\Users\Admin\AppData\Local\Temp\arirrylhnq8.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\arirrylhnq8.exe"C:\Users\Admin\AppData\Local\Temp\arirrylhnq8.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4016
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- System policy modification
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3652 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\arirrylhnq8.exe"3⤵PID:2892
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3680
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4076
-
-
-
C:\Program Files (x86)\Zu8axqht\9ralglktul.exe"C:\Program Files (x86)\Zu8axqht\9ralglktul.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3948 -
C:\Program Files (x86)\Zu8axqht\9ralglktul.exe"C:\Program Files (x86)\Zu8axqht\9ralglktul.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3820
-
-