46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
130s
max time network
141s
platform
windows10_x64
resource
win10
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/f660284cb3574213a512e3f03ca9012b.exe

Score

8^/10

spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

tapi3.exetapi3.exe

pid process

3776 tapi3.exe
3984 tapi3.exe
Loads dropped DLL 1 IoCs

Processes:

tapi3.exe

pid process

3776 tapi3.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

tapi3.exe

description pid process target process

PID 3776 set thread context of 3984 3776 tapi3.exe tapi3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3140 3984 WerFault.exe tapi3.exe

pid	process
3776	tapi3.exe
3984	tapi3.exe

pid	process
3776	tapi3.exe

description	pid	process	target process
PID 3776 set thread context of 3984	3776	tapi3.exe	tapi3.exe

pid	pid_target	process	target process
3140	3984	WerFault.exe	tapi3.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\tapi3.exe	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

f660284cb3574213a512e3f03ca9012b.exetapi3.exeWerFault.exe

pid	process
3824	f660284cb3574213a512e3f03ca9012b.exe
3984	tapi3.exe
3984	tapi3.exe
3984	tapi3.exe
3984	tapi3.exe
3984	tapi3.exe
3984	tapi3.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

tapi3.exe

pid process

3776 tapi3.exe

pid	process
3776	tapi3.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

f660284cb3574213a512e3f03ca9012b.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3824	f660284cb3574213a512e3f03ca9012b.exe
Token: SeRestorePrivilege	3140	WerFault.exe
Token: SeBackupPrivilege	3140	WerFault.exe
Token: SeDebugPrivilege	3140	WerFault.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f660284cb3574213a512e3f03ca9012b.exetapi3.exe

description	pid	process	target process
PID 3824 wrote to memory of 3776	3824	f660284cb3574213a512e3f03ca9012b.exe	tapi3.exe
PID 3824 wrote to memory of 3776	3824	f660284cb3574213a512e3f03ca9012b.exe	tapi3.exe
PID 3824 wrote to memory of 3776	3824	f660284cb3574213a512e3f03ca9012b.exe	tapi3.exe
PID 3776 wrote to memory of 3984	3776	tapi3.exe	tapi3.exe
PID 3776 wrote to memory of 3984	3776	tapi3.exe	tapi3.exe
PID 3776 wrote to memory of 3984	3776	tapi3.exe	tapi3.exe
PID 3776 wrote to memory of 3984	3776	tapi3.exe	tapi3.exe

C:\Users\Admin\AppData\Local\Temp\foo\f660284cb3574213a512e3f03ca9012b.exe
"C:\Users\Admin\AppData\Local\Temp\foo\f660284cb3574213a512e3f03ca9012b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Temp\tapi3.exe
  "C:\Users\Admin\AppData\Local\Temp\tapi3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Users\Admin\AppData\Local\Temp\tapi3.exe
    "C:\Users\Admin\AppData\Local\Temp\tapi3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1124
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tapi3.exe

MD5
4602bfa826f04c748b57e01fa31192ac

SHA1
37b5dd1872a7dbdc4615a2bd80c331bb621d1863

SHA256
e7ad7f90257bc5377599d6088d482121a2516adec2f62629e63ce53d47649a10

SHA512
77cc5ba056cc3574d5bff907ecca1f82d7cb9ce019c97b0bcbe4b567c055573f3735ef383515f71f3bf30872e00767cd76ded3d5eaf9feb9564b5e3f438e981c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tapi3.exe

MD5
4602bfa826f04c748b57e01fa31192ac

SHA1
37b5dd1872a7dbdc4615a2bd80c331bb621d1863

SHA256
e7ad7f90257bc5377599d6088d482121a2516adec2f62629e63ce53d47649a10

SHA512
77cc5ba056cc3574d5bff907ecca1f82d7cb9ce019c97b0bcbe4b567c055573f3735ef383515f71f3bf30872e00767cd76ded3d5eaf9feb9564b5e3f438e981c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tapi3.exe

MD5
4602bfa826f04c748b57e01fa31192ac

SHA1
37b5dd1872a7dbdc4615a2bd80c331bb621d1863

SHA256
e7ad7f90257bc5377599d6088d482121a2516adec2f62629e63ce53d47649a10

SHA512
77cc5ba056cc3574d5bff907ecca1f82d7cb9ce019c97b0bcbe4b567c055573f3735ef383515f71f3bf30872e00767cd76ded3d5eaf9feb9564b5e3f438e981c

Download Submit
\Users\Admin\AppData\Local\Temp\nsq33CE.tmp\System.dll

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/3140-14-0x0000000004110000-0x0000000004111000-memory.dmp

Filesize
4KB

Download
memory/3140-23-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download
memory/3776-5-0x0000000000000000-mapping.dmp

Download
memory/3824-1-0x0000000073B00000-0x00000000741EE000-memory.dmp

Filesize
6.9MB

Download
memory/3824-2-0x0000000004DF0000-0x0000000004EC9000-memory.dmp

Filesize
868KB

Download
memory/3824-3-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3824-4-0x0000000004CF0000-0x0000000004DC7000-memory.dmp

Filesize
860KB

Download
memory/3824-0-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3984-10-0x000000000045815A-mapping.dmp

Download
memory/3984-12-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3984-15-0x000000000045815A-mapping.dmp

Download
memory/3984-16-0x000000000045815A-mapping.dmp

Download
memory/3984-17-0x000000000045815A-mapping.dmp

Download
memory/3984-18-0x000000000045815A-mapping.dmp

Download
memory/3984-19-0x000000000045815A-mapping.dmp

Download
memory/3984-20-0x000000000045815A-mapping.dmp

Download
memory/3984-21-0x000000000045815A-mapping.dmp

Download
memory/3984-22-0x000000000045815A-mapping.dmp

Download
memory/3984-9-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download