Analysis
- max time kernel
113s - max time network
113s - platform
windows10_x64 - resource
win10 - submitted
02/10/2020, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
shedy765.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
shedy765.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target shedy765.exe
- Size 368KB
- Sample201002-rfypjbtzln
- SHA256 72286e5ebe72beafd0dea49af017caeaefbf8246220bb880c331dac576f99500
- MD5 cbd2905f79f7c384fceeb0380bae4742
- SHA1 0c09bbf785c99bbda83a6c6235cbb6b28d4329ab
- SHA512 a7c6a4fc529f0359a0d91eb4402f768ff17cee5c1046a364cc08ccca08c8e1b4fa415e51aa1f61bc236f73d2bd55f806964ad290a7d7990baae7bcd7d4851c88
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- ServiceHost packer 1 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/32-7-0x0000000000000000-mapping.dmp servicehost - Loads dropped DLL 1 IoCs
pid Process 208 rundll32.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 208 rundll32.exe 32 MSBuild.exe 32 MSBuild.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 208 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 32 MSBuild.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 32 MSBuild.exe - Suspicious use of WriteProcessMemory 86 IoCs
description pid Process procid_target PID 3828 wrote to memory of 208 3828 shedy765.exe 73 PID 3828 wrote to memory of 208 3828 shedy765.exe 73 PID 3828 wrote to memory of 208 3828 shedy765.exe 73 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74 PID 208 wrote to memory of 32 208 rundll32.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\shedy765.exe"C:\Users\Admin\AppData\Local\Temp\shedy765.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe Holotype,Bibliopegy2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:32
-
-