Analysis
- max time kernel
151s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/11/2020, 18:06
General
- Target ce82ae2cbc05636b73e29b11fcfbb62ffc7d210b6ef7d56de111f0fabc1c7838.exe
- Size 456KB
- Sample201108-qkkdr53js6
- SHA256 ce82ae2cbc05636b73e29b11fcfbb62ffc7d210b6ef7d56de111f0fabc1c7838
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Drops startup file 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce82ae2cbc05636b73e29b11fcfbb62ffc7d210b6ef7d56de111f0fabc1c7838.exe"C:\Users\Admin\AppData\Local\Temp\ce82ae2cbc05636b73e29b11fcfbb62ffc7d210b6ef7d56de111f0fabc1c7838.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"\\.\C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v "Intel GPU" /d "C:\Program Files\Intel GPU\GfxUI.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\ce82ae2cbc05636b73e29b11fcfbb62ffc7d210b6ef7d56de111f0fabc1c7838.exe"C:\Users\Admin\AppData\Local\Temp\ce82ae2cbc05636b73e29b11fcfbb62ffc7d210b6ef7d56de111f0fabc1c7838.exe" silent pause2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"\\.\C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/508-4-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/508-36-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/508-65-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/508-28-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/508-22-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/508-9-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/508-3-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/508-0-0x0000000063080000-0x00000000631EC000-memory.dmp
memory/508-2-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/508-1-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/1656-302-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/1656-300-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/1656-243-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/1656-233-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/1656-232-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/1656-231-0x0000000063080000-0x00000000631EC000-memory.dmp
memory/2656-344-0x0000000002960000-0x0000000002961000-memory.dmp
memory/2656-424-0x0000000002960000-0x0000000002961000-memory.dmp
memory/2656-310-0x0000000002960000-0x0000000002961000-memory.dmp
memory/2656-312-0x0000000002960000-0x0000000002961000-memory.dmp
memory/2656-308-0x0000000063080000-0x00000000631EC000-memory.dmp
memory/2656-315-0x0000000002960000-0x0000000002961000-memory.dmp
memory/2656-449-0x0000000002960000-0x0000000002961000-memory.dmp
memory/2656-423-0x0000000002960000-0x0000000002961000-memory.dmp
memory/2656-447-0x0000000002960000-0x0000000002961000-memory.dmp
memory/3008-435-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3008-446-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3008-376-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3008-313-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3008-316-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3008-311-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3008-309-0x0000000063080000-0x00000000631EC000-memory.dmp
memory/3288-77-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3288-141-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3288-76-0x0000000063080000-0x00000000631EC000-memory.dmp
memory/3288-78-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3288-120-0x0000000002860000-0x0000000002861000-memory.dmp
memory/4012-163-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/4012-154-0x0000000063080000-0x00000000631EC000-memory.dmp
memory/4012-155-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/4012-156-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/4012-229-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/4012-219-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/4012-226-0x00000000027D0000-0x00000000027D1000-memory.dmp