Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10 - submitted
04/08/2020, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
order list.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target order list.exe
- Size 936KB
- Sample200804-9f46h4rsjs
- SHA256 474af782fd84f7b982a4c49deeaf3431aeadd1e52528dc7dd8e3bb29bde9c40f
- MD5 641a91628f244dad6fa507b6e07e05b6
- SHA1 cd3aaa84b47109e398e728290fb23cff1ce7eecf
- SHA512 85812f0498bd868314c5424bd99981eeca934faf983ae5ff024872fd7d31726b8ec2a2e608d233f8e54a16db6e5e33b180ab25e4d0ff9de2ed9b26542b1fd56f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Gmp-\wnu2dc8plz8.exe explorer.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UXD4LBJ0BV = "C:\\Program Files (x86)\\Gmp-\\wnu2dc8plz8.exe" explorer.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3588 order list.exe Token: SeDebugPrivilege 4068 order list.exe Token: SeDebugPrivilege 3792 explorer.exe Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 3588 order list.exe 4068 order list.exe 4068 order list.exe 4068 order list.exe 4068 order list.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4068 order list.exe 4068 order list.exe 4068 order list.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe 3792 explorer.exe - Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/4068-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/4068-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/4068-1-0x000000000041E360-mapping.dmp formbook behavioral2/memory/3792-2-0x0000000000000000-mapping.dmp formbook -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3588 wrote to memory of 4068 3588 order list.exe 67 PID 3588 wrote to memory of 4068 3588 order list.exe 67 PID 3588 wrote to memory of 4068 3588 order list.exe 67 PID 3588 wrote to memory of 4068 3588 order list.exe 67 PID 3588 wrote to memory of 4068 3588 order list.exe 67 PID 3588 wrote to memory of 4068 3588 order list.exe 67 PID 2972 wrote to memory of 3792 2972 Explorer.EXE 68 PID 2972 wrote to memory of 3792 2972 Explorer.EXE 68 PID 2972 wrote to memory of 3792 2972 Explorer.EXE 68 PID 3792 wrote to memory of 3172 3792 explorer.exe 71 PID 3792 wrote to memory of 3172 3792 explorer.exe 71 PID 3792 wrote to memory of 3172 3792 explorer.exe 71 PID 3792 wrote to memory of 852 3792 explorer.exe 77 PID 3792 wrote to memory of 852 3792 explorer.exe 77 PID 3792 wrote to memory of 852 3792 explorer.exe 77 PID 3792 wrote to memory of 1148 3792 explorer.exe 79 PID 3792 wrote to memory of 1148 3792 explorer.exe 79 PID 3792 wrote to memory of 1148 3792 explorer.exe 79 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3588 set thread context of 4068 3588 order list.exe 67 PID 4068 set thread context of 2972 4068 order list.exe 56 PID 3792 set thread context of 2972 3792 explorer.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:4068
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Drops file in Program Files directory
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3792 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\order list.exe"3⤵PID:3172
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:852
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1148
-
-