ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa

Analysis

max time kernel
99s
max time network
134s
platform
windows10_x64
resource
win10v200722
submitted
19/10/2020, 09:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe
Size 1.4MB
Sample201019-etna6nc95j
SHA256 ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa
MD5 fc8524499f41643040871881b13b0ef0
SHA1 ca4934b430604832fbcd9e3e8c63195ba617eff5
SHA512 4005eca6bfa6070ef60fd0862c0830862cef65c92ab4aacec657d68cbac7974a7b3ac40ae722843a511dbbd87023d63e0ddb0b94b0e93cdb169ed5308c2b7548
MD5 SHA1 SHA512

Score

9^/10

spyware stealer

Malware Config

Signatures

ServiceHost packer 9 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/3960-237-0x000000000045C07D-mapping.dmp	servicehost
behavioral2/memory/3960-238-0x000000000045C07D-mapping.dmp	servicehost
behavioral2/memory/3960-239-0x000000000045C07D-mapping.dmp	servicehost
behavioral2/memory/3960-240-0x000000000045C07D-mapping.dmp	servicehost
behavioral2/memory/3960-241-0x000000000045C07D-mapping.dmp	servicehost
behavioral2/memory/3960-242-0x000000000045C07D-mapping.dmp	servicehost
behavioral2/memory/3960-243-0x000000000045C07D-mapping.dmp	servicehost
behavioral2/memory/3960-244-0x000000000045C07D-mapping.dmp	servicehost
behavioral2/memory/3960-245-0x000000000045C07D-mapping.dmp	servicehost

Executes dropped EXE 3 IoCs

pid	Process
752	explorer.com
3076	explorer.com
3960	nslookup.exe

Loads dropped DLL 2 IoCs

pid	Process
3960	nslookup.exe
3960	nslookup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0002000000015652-229.dat	js

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3076 set thread context of 3960	3076	explorer.com	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	3960	WerFault.exe	88

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3396	PING.EXE
796	PING.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3960	nslookup.exe
3960	nslookup.exe
3960	nslookup.exe
3960	nslookup.exe
3960	nslookup.exe
3960	nslookup.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3076	explorer.com

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1696	WerFault.exe
Token: SeBackupPrivilege	1696	WerFault.exe
Token: SeDebugPrivilege	1696	WerFault.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 4016	60	ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe	73
PID 60 wrote to memory of 4016	60	ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe	73
PID 60 wrote to memory of 4016	60	ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe	73
PID 60 wrote to memory of 3852	60	ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe	75
PID 60 wrote to memory of 3852	60	ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe	75
PID 60 wrote to memory of 3852	60	ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe	75
PID 3852 wrote to memory of 3948	3852	cmd.exe	77
PID 3852 wrote to memory of 3948	3852	cmd.exe	77
PID 3852 wrote to memory of 3948	3852	cmd.exe	77
PID 3948 wrote to memory of 3396	3948	cmd.exe	78
PID 3948 wrote to memory of 3396	3948	cmd.exe	78
PID 3948 wrote to memory of 3396	3948	cmd.exe	78
PID 3948 wrote to memory of 992	3948	cmd.exe	79
PID 3948 wrote to memory of 992	3948	cmd.exe	79
PID 3948 wrote to memory of 992	3948	cmd.exe	79
PID 3948 wrote to memory of 752	3948	cmd.exe	80
PID 3948 wrote to memory of 752	3948	cmd.exe	80
PID 3948 wrote to memory of 752	3948	cmd.exe	80
PID 3948 wrote to memory of 796	3948	cmd.exe	81
PID 3948 wrote to memory of 796	3948	cmd.exe	81
PID 3948 wrote to memory of 796	3948	cmd.exe	81
PID 752 wrote to memory of 3076	752	explorer.com	83
PID 752 wrote to memory of 3076	752	explorer.com	83
PID 752 wrote to memory of 3076	752	explorer.com	83
PID 60 wrote to memory of 192	60	ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe	86
PID 60 wrote to memory of 192	60	ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe	86
PID 60 wrote to memory of 192	60	ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe	86
PID 3076 wrote to memory of 3960	3076	explorer.com	88
PID 3076 wrote to memory of 3960	3076	explorer.com	88
PID 3076 wrote to memory of 3960	3076	explorer.com	88
PID 3076 wrote to memory of 3960	3076	explorer.com	88

C:\Users\Admin\AppData\Local\Temp\ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe
"C:\Users\Admin\AppData\Local\Temp\ec855bf0f35b2f38db047587591d3963f2836dfb73c4894590df75378ed7ebfa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo YswcFp
  2⤵
  PID:4016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < FzlB.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 hdrPZ.aDoWd
      4⤵
      Runs ping.exe
      PID:3396
  - - C:\Windows\SysWOW64\certutil.exe
      certutil -decode GFcgmzhMmFw.com W
      4⤵
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\explorer.com
      explorer.com W
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\explorer.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\explorer.com W
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\nslookup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\nslookup.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1200
        7⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 3
      4⤵
      Runs ping.exe
      PID:796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  PID:192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-235-0x0000000004C20000-0x0000000004C21000-memory.dmp

Download

memory/1696-246-0x0000000005350000-0x0000000005351000-memory.dmp

Download

memory/3960-18-0x0000000000400000-0x000000000048E000-memory.dmp

Download

memory/3960-21-0x0000000000400000-0x000000000048E000-memory.dmp

Download