41ec47ce62f13677c0c4576c97e299471072aa9ade05670ad0aefdbbd9187fca

Analysis

max time kernel
18s
max time network
68s
platform
windows10_x64
resource
win10
submitted
19/10/2020, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1ba2aedc401678326d99fbb0bddbcc7.exe
Size 875KB
Sample201019-1tkcpj1wc6
SHA256 41ec47ce62f13677c0c4576c97e299471072aa9ade05670ad0aefdbbd9187fca
MD5 d1ba2aedc401678326d99fbb0bddbcc7
SHA1 42d9d42765d6170c816482339a0d594836bf73de
SHA512 1a3309e3669e1147dae3ee07c4551bb009396ab925215200dc842dd3a47f29f7f2be29a4ecd785fe038166d4a1c5a8749eecf2afbfa6494d1814ee92ad33c6d1
MD5 SHA1 SHA512

Score

8^/10

spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
808	A.exe
1716	B.exe

Deletes itself 1 IoCs

pid	Process
2156	WScript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	d1ba2aedc401678326d99fbb0bddbcc7.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
808	A.exe
808	A.exe
808	A.exe
808	A.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 2956	3536	d1ba2aedc401678326d99fbb0bddbcc7.exe	73
PID 3536 wrote to memory of 2956	3536	d1ba2aedc401678326d99fbb0bddbcc7.exe	73
PID 3536 wrote to memory of 2956	3536	d1ba2aedc401678326d99fbb0bddbcc7.exe	73
PID 2956 wrote to memory of 808	2956	cmd.exe	75
PID 2956 wrote to memory of 808	2956	cmd.exe	75
PID 2956 wrote to memory of 808	2956	cmd.exe	75
PID 3536 wrote to memory of 1808	3536	d1ba2aedc401678326d99fbb0bddbcc7.exe	79
PID 3536 wrote to memory of 1808	3536	d1ba2aedc401678326d99fbb0bddbcc7.exe	79
PID 3536 wrote to memory of 1808	3536	d1ba2aedc401678326d99fbb0bddbcc7.exe	79
PID 1808 wrote to memory of 1716	1808	cmd.exe	81
PID 1808 wrote to memory of 1716	1808	cmd.exe	81
PID 1808 wrote to memory of 1716	1808	cmd.exe	81
PID 3536 wrote to memory of 2156	3536	d1ba2aedc401678326d99fbb0bddbcc7.exe	82
PID 3536 wrote to memory of 2156	3536	d1ba2aedc401678326d99fbb0bddbcc7.exe	82
PID 3536 wrote to memory of 2156	3536	d1ba2aedc401678326d99fbb0bddbcc7.exe	82

C:\Users\Admin\AppData\Local\Temp\d1ba2aedc401678326d99fbb0bddbcc7.exe
"C:\Users\Admin\AppData\Local\Temp\d1ba2aedc401678326d99fbb0bddbcc7.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c A.exe /stext A.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\A.exe
    A.exe /stext A.txt
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c B.exe /stext B.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\B.exe
    B.exe /stext B.txt
    3⤵
    - Executes dropped EXE
    PID:1716
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d.vbs"
  2⤵
  - Deletes itself
  PID:2156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads