Analysis
- max time kernel
126s - max time network
151s - platform
windows10_x64 - resource
win10 - submitted
08/10/2020, 12:27
General
- Target Anfrage für ein Angebot.exe
- Size 1.1MB
- Sample201008-af52c5vgaj
- SHA256 ad17d05d9bf7bb701bee55b078a0608a038e44a3c1c24b06b3eea34bfcdb280c
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Anfrage für ein Angebot.exe"C:\Users\Admin\AppData\Local\Temp\Anfrage für ein Angebot.exe"1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Anfrage für ein Angebot.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3500-25-0x0000000007F80000-0x0000000007F81000-memory.dmp
memory/3500-23-0x0000000007710000-0x0000000007711000-memory.dmp
memory/3500-39-0x0000000009150000-0x0000000009151000-memory.dmp
memory/3500-37-0x0000000009160000-0x0000000009161000-memory.dmp
memory/3500-17-0x0000000004430000-0x0000000004431000-memory.dmp
memory/3500-36-0x00000000091B0000-0x00000000091B1000-memory.dmp
memory/3500-35-0x0000000008FF0000-0x0000000008FF1000-memory.dmp
memory/3500-16-0x0000000073BA0000-0x000000007428E000-memory.dmp
memory/3500-27-0x0000000008EA0000-0x0000000008ED3000-memory.dmp
memory/3500-24-0x0000000008110000-0x0000000008111000-memory.dmp
memory/3500-22-0x0000000007920000-0x0000000007921000-memory.dmp
memory/3500-20-0x0000000007640000-0x0000000007641000-memory.dmp
memory/3500-34-0x0000000008E80000-0x0000000008E81000-memory.dmp
memory/3500-19-0x0000000007490000-0x0000000007491000-memory.dmp
memory/3500-18-0x0000000006DF0000-0x0000000006DF1000-memory.dmp
memory/3676-5-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/3676-1-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/3676-13-0x000000000E060000-0x000000000E061000-memory.dmp
memory/3676-15-0x000000000E880000-0x000000000E881000-memory.dmp
memory/3676-10-0x000000000D5B0000-0x000000000D630000-memory.dmp
memory/3676-0-0x0000000073BA0000-0x000000007428E000-memory.dmp
memory/3676-9-0x000000000D650000-0x000000000D651000-memory.dmp
memory/3676-8-0x000000000A140000-0x000000000A20F000-memory.dmp
memory/3676-7-0x0000000007950000-0x0000000007A1C000-memory.dmp
memory/3676-6-0x0000000002FE0000-0x0000000002FE4000-memory.dmp
memory/3676-4-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/3676-3-0x0000000005940000-0x0000000005941000-memory.dmp