53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809

Analysis

max time kernel
151s
max time network
67s
platform
windows7_x64
resource
win7v20201028
submitted
08/11/2020, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
Size 482KB
Sample201108-des68gbrce
SHA256 53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809
MD5 b59150d73e646be607edc38e2c714117
SHA1 692092a82087cda994f46cd844f5aa289c822347
SHA512 2b068f2a137ae7c00efdcfab8d2666daa1c27685f7cd11388d0407880ded4ebf9bcefd3fcbbbfa94fcae24f60e202fb29768e95b7e4cfe9367d5e9b68207e52c
MD5 SHA1 SHA512

Score

8^/10

persistence spyware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
980	SearchHelper.exe
820	com3.exe
1500	SearchHelper.exe
812	com3.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareIt Service.exe	SearchHelper.exe

Loads dropped DLL 7 IoCs

pid	Process
844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Intel GPU = "C:\\Program Files\\Intel GPU\\GfxUI.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Search Helper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Search\\SearchHelper.exe"	com3.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Intel GPU\GfxUI.exe	com3.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
560	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
980	SearchHelper.exe
820	com3.exe
1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
1500	SearchHelper.exe
812	com3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	SearchHelper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
980	SearchHelper.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 980	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	29
PID 844 wrote to memory of 980	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	29
PID 844 wrote to memory of 980	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	29
PID 844 wrote to memory of 980	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	29
PID 844 wrote to memory of 820	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	30
PID 844 wrote to memory of 820	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	30
PID 844 wrote to memory of 820	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	30
PID 844 wrote to memory of 820	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	30
PID 844 wrote to memory of 1752	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	31
PID 844 wrote to memory of 1752	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	31
PID 844 wrote to memory of 1752	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	31
PID 844 wrote to memory of 1752	844	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	31
PID 1752 wrote to memory of 1500	1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	32
PID 1752 wrote to memory of 1500	1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	32
PID 1752 wrote to memory of 1500	1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	32
PID 1752 wrote to memory of 1500	1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	32
PID 1752 wrote to memory of 812	1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	33
PID 1752 wrote to memory of 812	1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	33
PID 1752 wrote to memory of 812	1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	33
PID 1752 wrote to memory of 812	1752	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	33
PID 820 wrote to memory of 560	820	com3.exe	34
PID 820 wrote to memory of 560	820	com3.exe	34
PID 820 wrote to memory of 560	820	com3.exe	34
PID 820 wrote to memory of 560	820	com3.exe	34

C:\Users\Admin\AppData\Local\Temp\53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
"C:\Users\Admin\AppData\Local\Temp\53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:980
- C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe
  "\\.\C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v "Intel GPU" /d "C:\Program Files\Intel GPU\GfxUI.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:560
- C:\Users\Admin\AppData\Local\Temp\53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
  "C:\Users\Admin\AppData\Local\Temp\53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe" silent pause
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe
    "\\.\C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-144-0x00000000021E0000-0x00000000021F1000-memory.dmp

Download

memory/812-146-0x00000000021E0000-0x00000000021F1000-memory.dmp

Download

memory/812-182-0x00000000021E0000-0x00000000021F1000-memory.dmp

Download

memory/812-195-0x00000000021E0000-0x00000000021F1000-memory.dmp

Download

memory/812-196-0x00000000021E0000-0x00000000021F1000-memory.dmp

Download

memory/820-97-0x00000000023F0000-0x0000000002401000-memory.dmp

Download

memory/820-86-0x00000000023F0000-0x0000000002401000-memory.dmp

Download

memory/820-67-0x00000000023F0000-0x0000000002401000-memory.dmp

Download

memory/820-68-0x00000000023F0000-0x0000000002401000-memory.dmp

Download

memory/844-1-0x00000000021D0000-0x00000000021E1000-memory.dmp

Download

memory/844-2-0x00000000021D0000-0x00000000021E1000-memory.dmp

Download

memory/844-20-0x00000000021D0000-0x00000000021E1000-memory.dmp

Download

memory/844-0-0x0000000063080000-0x00000000631EC000-memory.dmp

Download

memory/980-31-0x00000000020E0000-0x00000000020F1000-memory.dmp

Download

memory/980-50-0x00000000020E0000-0x00000000020F1000-memory.dmp

Download

memory/980-32-0x00000000020E0000-0x00000000020F1000-memory.dmp

Download

memory/980-54-0x00000000020E0000-0x00000000020F1000-memory.dmp

Download

memory/1500-191-0x0000000002500000-0x0000000002511000-memory.dmp

Download

memory/1500-138-0x0000000002500000-0x0000000002511000-memory.dmp

Download

memory/1500-140-0x0000000002500000-0x0000000002511000-memory.dmp

Download

memory/1500-175-0x0000000002500000-0x0000000002511000-memory.dmp

Download

memory/1752-133-0x0000000002200000-0x0000000002211000-memory.dmp

Download

memory/1752-127-0x0000000002200000-0x0000000002211000-memory.dmp

Download

memory/1752-119-0x0000000002200000-0x0000000002211000-memory.dmp

Download

memory/1752-128-0x0000000002200000-0x0000000002211000-memory.dmp

Download

memory/1752-101-0x0000000002200000-0x0000000002211000-memory.dmp

Download

memory/1752-100-0x0000000002200000-0x0000000002211000-memory.dmp

Download