Analysis
-
max time kernel
16s -
max time network
118s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-11-2020 07:53
Static task
static1
Behavioral task
behavioral1
Sample
97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exe
Resource
win7v20201028
General
-
Target
97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exe
-
Size
589KB
-
MD5
cb012d603d143ba32014c24a0f5aafa3
-
SHA1
eab1d2959d4f7dde4bc69cc355071565a2cf3553
-
SHA256
97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c
-
SHA512
ae118dd8cd51e615cd4312d80c8a5fc2cb03ac3dcb2eaea65464800a6942f908b2d3191b2f3ef49180803757c642c4cdd93908dfa99d1e0d42eacf506e9de6af
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
SU5DC5.tmppid process 3248 SU5DC5.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.ipify.org -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SU5DC5.tmpdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SU5DC5.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SU5DC5.tmp -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exeSU5DC5.tmppid process 640 97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exe 640 97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exe 3248 SU5DC5.tmp 3248 SU5DC5.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exedescription pid process target process PID 640 wrote to memory of 3248 640 97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exe SU5DC5.tmp PID 640 wrote to memory of 3248 640 97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exe SU5DC5.tmp PID 640 wrote to memory of 3248 640 97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exe SU5DC5.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exe"C:\Users\Admin\AppData\Local\Temp\97ae0539568cfb2e8a4d2f156b190f2c53e5cacdc38b2f3af3fac3e61a16230c.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SU5DC5.tmpC:\Users\Admin\AppData\Local\Temp\SU5DC5.tmp2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SU5DC5.tmpMD5
b1e90e6ef07e0b4ed5ee6aee4a7bd319
SHA1a530298c46e7190b8e085116bd8a59297f1aa82e
SHA256dc021a0ca0bb3f66d54d15d2b236422c0b90399ea762c7d7aa6d727b9bd5b46c
SHA5125dd5bb01b3520c07d7b8147f9669e69fc264d82d595b92f8cc9b3d96f53addadd2291b003b3aa1dd2197ade1213d7a30d166fd893c7b56e8979713082dc17b55
-
C:\Users\Admin\AppData\Local\Temp\SU5DC5.tmpMD5
b1e90e6ef07e0b4ed5ee6aee4a7bd319
SHA1a530298c46e7190b8e085116bd8a59297f1aa82e
SHA256dc021a0ca0bb3f66d54d15d2b236422c0b90399ea762c7d7aa6d727b9bd5b46c
SHA5125dd5bb01b3520c07d7b8147f9669e69fc264d82d595b92f8cc9b3d96f53addadd2291b003b3aa1dd2197ade1213d7a30d166fd893c7b56e8979713082dc17b55
-
memory/3248-0-0x0000000000000000-mapping.dmp