9aaa435667bdb311821884dbb7bb6866fe8daa5a09edaf9d5c0d2856827edcfe

General

Target
bc8704a90dfd3b1e4904da0af4b1b588.exe
Size 476KB
Sample200907-djq9plhamn
SHA256 9aaa435667bdb311821884dbb7bb6866fe8daa5a09edaf9d5c0d2856827edcfe
MD5 bc8704a90dfd3b1e4904da0af4b1b588
SHA1 e2d17234f2fa57ace6eb5b9ec9e86bbb1d37253d
SHA512 7b926fb07089f8394e873d489971497521a963fc2ed097da66f756a1d0877d93a605b8f5fba42b5f3e2c02869c600d59c041b961746afba9f18c44a9f0bbe2b6
MD5 SHA1 SHA512

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
508	bc8704a90dfd3b1e4904da0af4b1b588.exe
508	bc8704a90dfd3b1e4904da0af4b1b588.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0004000000015654-72.dat	js

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bc8704a90dfd3b1e4904da0af4b1b588.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bc8704a90dfd3b1e4904da0af4b1b588.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3980	taskkill.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 556e9c670585d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	612	svchost.exe
Token: SeCreatePagefilePrivilege	612	svchost.exe
Token: SeDebugPrivilege	3980	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 3720	508	bc8704a90dfd3b1e4904da0af4b1b588.exe	76
PID 508 wrote to memory of 3720	508	bc8704a90dfd3b1e4904da0af4b1b588.exe	76
PID 508 wrote to memory of 3720	508	bc8704a90dfd3b1e4904da0af4b1b588.exe	76
PID 3720 wrote to memory of 3980	3720	cmd.exe	78
PID 3720 wrote to memory of 3980	3720	cmd.exe	78
PID 3720 wrote to memory of 3980	3720	cmd.exe	78