Analysis

  • max time kernel
    151s
  • max time network
    120s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    08/10/2020, 11:56

General

  • Target
    28ed1a03d61d424938945d0b139d0f84.exe
  • Size 564KB
  • Sample201008-2gcq7194e6
  • SHA256 9d36d33688fefea55f7b2b7c25165ab3a85319b5f466174fa2396537187eabe0
  • MD5 SHA1 SHA512
Score
7/10

Malware Config

Signatures

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18547 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\28ed1a03d61d424938945d0b139d0f84.exe
    "C:\Users\Admin\AppData\Local\Temp\28ed1a03d61d424938945d0b139d0f84.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1084
    • C:\Users\Admin\AppData\Local\Temp\28ed1a03d61d424938945d0b139d0f84.exe
      "C:\Users\Admin\AppData\Local\Temp\28ed1a03d61d424938945d0b139d0f84.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:2144
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:2148
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2156

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1084-12-0x0000000005880000-0x0000000005881000-memory.dmp

            memory/1084-11-0x0000000005D80000-0x0000000005D81000-memory.dmp

            memory/1084-8-0x0000000073580000-0x0000000073C6E000-memory.dmp

            memory/1084-6-0x0000000000400000-0x000000000043C000-memory.dmp

            memory/1636-14-0x0000000073580000-0x0000000073C6E000-memory.dmp

            memory/1636-20-0x0000000004D40000-0x0000000004D7C000-memory.dmp

            memory/1756-4-0x00000000052E0000-0x000000000531D000-memory.dmp

            memory/1756-3-0x0000000004D40000-0x0000000004D41000-memory.dmp

            memory/1756-1-0x0000000000470000-0x0000000000471000-memory.dmp

            memory/1756-0-0x0000000073580000-0x0000000073C6E000-memory.dmp

            memory/2156-24-0x0000000073580000-0x0000000073C6E000-memory.dmp

            memory/2156-29-0x0000000005A10000-0x0000000005A11000-memory.dmp

            memory/2156-30-0x0000000006290000-0x0000000006291000-memory.dmp

            memory/2156-32-0x0000000006640000-0x0000000006641000-memory.dmp