53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809

Analysis

max time kernel
151s
max time network
144s
platform
windows10_x64
resource
win10v20201028
submitted
08/11/2020, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
Size 482KB
Sample201108-des68gbrce
SHA256 53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809
MD5 b59150d73e646be607edc38e2c714117
SHA1 692092a82087cda994f46cd844f5aa289c822347
SHA512 2b068f2a137ae7c00efdcfab8d2666daa1c27685f7cd11388d0407880ded4ebf9bcefd3fcbbbfa94fcae24f60e202fb29768e95b7e4cfe9367d5e9b68207e52c
MD5 SHA1 SHA512

Score

8^/10

persistence spyware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1372	SearchHelper.exe
2928	com3.exe
864	SearchHelper.exe
3796	com3.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareIt Service.exe	SearchHelper.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel GPU = "C:\\Program Files\\Intel GPU\\GfxUI.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Search Helper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Search\\SearchHelper.exe"	com3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Intel GPU\GfxUI.exe	com3.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
820	reg.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
1372	SearchHelper.exe
1372	SearchHelper.exe
2928	com3.exe
2928	com3.exe
3156	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
3156	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
864	SearchHelper.exe
864	SearchHelper.exe
3796	com3.exe
3796	com3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	SearchHelper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1372	SearchHelper.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1372	580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	75
PID 580 wrote to memory of 1372	580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	75
PID 580 wrote to memory of 1372	580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	75
PID 580 wrote to memory of 2928	580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	78
PID 580 wrote to memory of 2928	580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	78
PID 580 wrote to memory of 2928	580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	78
PID 580 wrote to memory of 3156	580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	79
PID 580 wrote to memory of 3156	580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	79
PID 580 wrote to memory of 3156	580	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	79
PID 3156 wrote to memory of 864	3156	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	81
PID 3156 wrote to memory of 864	3156	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	81
PID 3156 wrote to memory of 864	3156	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	81
PID 3156 wrote to memory of 3796	3156	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	82
PID 3156 wrote to memory of 3796	3156	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	82
PID 3156 wrote to memory of 3796	3156	53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe	82
PID 2928 wrote to memory of 820	2928	com3.exe	83
PID 2928 wrote to memory of 820	2928	com3.exe	83
PID 2928 wrote to memory of 820	2928	com3.exe	83

C:\Users\Admin\AppData\Local\Temp\53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
"C:\Users\Admin\AppData\Local\Temp\53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:580
- C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1372
- C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe
  "\\.\C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v "Intel GPU" /d "C:\Program Files\Intel GPU\GfxUI.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:820
- C:\Users\Admin\AppData\Local\Temp\53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe
  "C:\Users\Admin\AppData\Local\Temp\53faffdd7ba520dcbe1f813ee44cdaf68d63d8802fb2f01c6b6e047e4b540809.exe" silent pause
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe
    "\\.\C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-12-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/580-63-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/580-60-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/580-45-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/580-32-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/580-3-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/580-0-0x0000000063080000-0x00000000631EC000-memory.dmp

Download

memory/580-2-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/580-1-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/864-443-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/864-306-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/864-311-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/864-303-0x0000000063080000-0x00000000631EC000-memory.dmp

Download

memory/864-304-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/864-392-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/864-427-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/1372-75-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/1372-145-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/1372-74-0x0000000063080000-0x00000000631EC000-memory.dmp

Download

memory/1372-76-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/1372-77-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/1372-86-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/1372-88-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/1372-137-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/1372-142-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/2928-213-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/2928-221-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/2928-150-0x0000000063080000-0x00000000631EC000-memory.dmp

Download

memory/2928-152-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/2928-151-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/2928-224-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/2928-163-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/3156-227-0x0000000002910000-0x0000000002911000-memory.dmp

Download

memory/3156-226-0x0000000063080000-0x00000000631EC000-memory.dmp

Download

memory/3156-228-0x0000000002910000-0x0000000002911000-memory.dmp

Download

memory/3156-295-0x0000000002910000-0x0000000002911000-memory.dmp

Download

memory/3156-297-0x0000000002910000-0x0000000002911000-memory.dmp

Download

memory/3796-310-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/3796-309-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/3796-398-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/3796-307-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/3796-441-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/3796-444-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/3796-305-0x0000000063080000-0x00000000631EC000-memory.dmp

Download