Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
05-11-2020 04:07
Static task
static1
Behavioral task
behavioral1
Sample
hl3x.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
hl3x.bin.exe
Resource
win10v20201028
General
-
Target
hl3x.bin.exe
-
Size
1.1MB
-
MD5
aa353bc3e7a9c6551c630970bd539d7f
-
SHA1
5466e81368431cc7d95d0e61ccad0532a7850a4b
-
SHA256
98527afb21c16cf3c62da74174d10c01f49070772bf8108ecae708b2420a53f9
-
SHA512
6bf7b873e9ed3acb6ea6f7782a67c549dadea0c33186767dd322818852193111a1f27a19dfd5c639f6c01bc73c9099d8327edd808d9c0509dd8ce91493c32349
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 744 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
hl3x.bin.exedescription pid process target process PID 300 set thread context of 2044 300 hl3x.bin.exe hl3x.bin.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1068 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
hl3x.bin.exedescription pid process Token: SeDebugPrivilege 300 hl3x.bin.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
hl3x.bin.exehl3x.bin.execmd.exedescription pid process target process PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 300 wrote to memory of 2044 300 hl3x.bin.exe hl3x.bin.exe PID 2044 wrote to memory of 744 2044 hl3x.bin.exe cmd.exe PID 2044 wrote to memory of 744 2044 hl3x.bin.exe cmd.exe PID 2044 wrote to memory of 744 2044 hl3x.bin.exe cmd.exe PID 2044 wrote to memory of 744 2044 hl3x.bin.exe cmd.exe PID 744 wrote to memory of 1068 744 cmd.exe timeout.exe PID 744 wrote to memory of 1068 744 cmd.exe timeout.exe PID 744 wrote to memory of 1068 744 cmd.exe timeout.exe PID 744 wrote to memory of 1068 744 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hl3x.bin.exe"C:\Users\Admin\AppData\Local\Temp\hl3x.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\hl3x.bin.exe"C:\Users\Admin\AppData\Local\Temp\hl3x.bin.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\hl3x.bin.exe3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\timeout.exetimeout /t 34⤵
- Delays execution with timeout.exe
PID:1068
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/300-0-0x0000000074DC0000-0x00000000754AE000-memory.dmpFilesize
6.9MB
-
memory/300-1-0x0000000001010000-0x0000000001011000-memory.dmpFilesize
4KB
-
memory/300-3-0x0000000000290000-0x00000000002BC000-memory.dmpFilesize
176KB
-
memory/300-4-0x00000000003D0000-0x00000000003DC000-memory.dmpFilesize
48KB
-
memory/744-9-0x0000000000000000-mapping.dmp
-
memory/1068-10-0x0000000000000000-mapping.dmp
-
memory/1280-8-0x000007FEF7D40000-0x000007FEF7FBA000-memory.dmpFilesize
2.5MB
-
memory/2044-5-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2044-6-0x0000000000416223-mapping.dmp
-
memory/2044-7-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB