46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
54s
max time network
71s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/f660284cb3574213a512e3f03ca9012b.exe

Score

8^/10

discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

tapi3.exetapi3.exe

pid process

1848 tapi3.exe
1356 tapi3.exe
Loads dropped DLL 3 IoCs

Processes:

f660284cb3574213a512e3f03ca9012b.exetapi3.exe

pid process

1796 f660284cb3574213a512e3f03ca9012b.exe
1848 tapi3.exe
1848 tapi3.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

tapi3.exe

description pid process target process

PID 1848 set thread context of 1356 1848 tapi3.exe tapi3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1848	tapi3.exe
1356	tapi3.exe

pid	process
1796	f660284cb3574213a512e3f03ca9012b.exe
1848	tapi3.exe
1848	tapi3.exe

flow	ioc
5	ip-api.com

description	pid	process	target process
PID 1848 set thread context of 1356	1848	tapi3.exe	tapi3.exe

NSIS installer 10 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

tapi3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tapi3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	tapi3.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

f660284cb3574213a512e3f03ca9012b.exetapi3.exe

pid process

1796 f660284cb3574213a512e3f03ca9012b.exe
1356 tapi3.exe
1356 tapi3.exe
1356 tapi3.exe
1356 tapi3.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

tapi3.exe

pid process

1848 tapi3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f660284cb3574213a512e3f03ca9012b.exe

description pid process

Token: SeDebugPrivilege 1796 f660284cb3574213a512e3f03ca9012b.exe

pid	process
1796	f660284cb3574213a512e3f03ca9012b.exe
1356	tapi3.exe
1356	tapi3.exe
1356	tapi3.exe
1356	tapi3.exe

pid	process
1848	tapi3.exe

description	pid	process
Token: SeDebugPrivilege	1796	f660284cb3574213a512e3f03ca9012b.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f660284cb3574213a512e3f03ca9012b.exetapi3.exetapi3.exe

description	pid	process	target process
PID 1796 wrote to memory of 1848	1796	f660284cb3574213a512e3f03ca9012b.exe	tapi3.exe
PID 1796 wrote to memory of 1848	1796	f660284cb3574213a512e3f03ca9012b.exe	tapi3.exe
PID 1796 wrote to memory of 1848	1796	f660284cb3574213a512e3f03ca9012b.exe	tapi3.exe
PID 1796 wrote to memory of 1848	1796	f660284cb3574213a512e3f03ca9012b.exe	tapi3.exe
PID 1848 wrote to memory of 1356	1848	tapi3.exe	tapi3.exe
PID 1848 wrote to memory of 1356	1848	tapi3.exe	tapi3.exe
PID 1848 wrote to memory of 1356	1848	tapi3.exe	tapi3.exe
PID 1848 wrote to memory of 1356	1848	tapi3.exe	tapi3.exe
PID 1848 wrote to memory of 1356	1848	tapi3.exe	tapi3.exe
PID 1356 wrote to memory of 1252	1356	tapi3.exe	cmd.exe
PID 1356 wrote to memory of 1252	1356	tapi3.exe	cmd.exe
PID 1356 wrote to memory of 1252	1356	tapi3.exe	cmd.exe
PID 1356 wrote to memory of 1252	1356	tapi3.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\foo\f660284cb3574213a512e3f03ca9012b.exe
"C:\Users\Admin\AppData\Local\Temp\foo\f660284cb3574213a512e3f03ca9012b.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\tapi3.exe
  "C:\Users\Admin\AppData\Local\Temp\tapi3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\tapi3.exe
    "C:\Users\Admin\AppData\Local\Temp\tapi3.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" rd /s /q C:\ProgramData\9QIRAPIGSY5C7S
      4⤵
      PID:1252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tapi3.exe

MD5
4602bfa826f04c748b57e01fa31192ac

SHA1
37b5dd1872a7dbdc4615a2bd80c331bb621d1863

SHA256
e7ad7f90257bc5377599d6088d482121a2516adec2f62629e63ce53d47649a10

SHA512
77cc5ba056cc3574d5bff907ecca1f82d7cb9ce019c97b0bcbe4b567c055573f3735ef383515f71f3bf30872e00767cd76ded3d5eaf9feb9564b5e3f438e981c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tapi3.exe

MD5
4602bfa826f04c748b57e01fa31192ac

SHA1
37b5dd1872a7dbdc4615a2bd80c331bb621d1863

SHA256
e7ad7f90257bc5377599d6088d482121a2516adec2f62629e63ce53d47649a10

SHA512
77cc5ba056cc3574d5bff907ecca1f82d7cb9ce019c97b0bcbe4b567c055573f3735ef383515f71f3bf30872e00767cd76ded3d5eaf9feb9564b5e3f438e981c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tapi3.exe

MD5
4602bfa826f04c748b57e01fa31192ac

SHA1
37b5dd1872a7dbdc4615a2bd80c331bb621d1863

SHA256
e7ad7f90257bc5377599d6088d482121a2516adec2f62629e63ce53d47649a10

SHA512
77cc5ba056cc3574d5bff907ecca1f82d7cb9ce019c97b0bcbe4b567c055573f3735ef383515f71f3bf30872e00767cd76ded3d5eaf9feb9564b5e3f438e981c

Download Submit
\Users\Admin\AppData\Local\Temp\nsf5735.tmp\System.dll

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
\Users\Admin\AppData\Local\Temp\tapi3.exe

MD5
4602bfa826f04c748b57e01fa31192ac

SHA1
37b5dd1872a7dbdc4615a2bd80c331bb621d1863

SHA256
e7ad7f90257bc5377599d6088d482121a2516adec2f62629e63ce53d47649a10

SHA512
77cc5ba056cc3574d5bff907ecca1f82d7cb9ce019c97b0bcbe4b567c055573f3735ef383515f71f3bf30872e00767cd76ded3d5eaf9feb9564b5e3f438e981c

Download Submit
\Users\Admin\AppData\Local\Temp\tapi3.exe

MD5
4602bfa826f04c748b57e01fa31192ac

SHA1
37b5dd1872a7dbdc4615a2bd80c331bb621d1863

SHA256
e7ad7f90257bc5377599d6088d482121a2516adec2f62629e63ce53d47649a10

SHA512
77cc5ba056cc3574d5bff907ecca1f82d7cb9ce019c97b0bcbe4b567c055573f3735ef383515f71f3bf30872e00767cd76ded3d5eaf9feb9564b5e3f438e981c

Download Submit
memory/1252-15-0x0000000000000000-mapping.dmp

Download
memory/1356-10-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1356-11-0x000000000045815A-mapping.dmp

Download
memory/1356-13-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1652-14-0x000007FEF7DE0000-0x000007FEF805A000-memory.dmp

Filesize
2.5MB

Download
memory/1796-3-0x0000000004920000-0x00000000049F7000-memory.dmp

Filesize
860KB

Download
memory/1796-2-0x0000000004A60000-0x0000000004B39000-memory.dmp

Filesize
868KB

Download
memory/1796-0-0x0000000001EA0000-0x0000000001EB1000-memory.dmp

Filesize
68KB

Download
memory/1796-1-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/1848-5-0x0000000000000000-mapping.dmp

Download