Analysis
- max time kernel
15s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
POL.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target POL.exe
- Size 873KB
- Sample201109-ngbfyk2ynj
- SHA256 fe966a744b83daaecb2b4b01adc7204e42d3f98955e142e78d7a948709185d27
- MD5 68a170452e42bcc18b6e91812a08cfc9
- SHA1 7b710b3d50f45e1f522341713fa24170454d9f48
- SHA512 280a492aa64912b9329902c22ec4535375673860519db8c65fae2c1fc6e49fed3005d3a20ed01d5e5661c71a32be5de610d97711e8649dd3b3ef1937e2b17b99
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1028 set thread context of 1340 1028 POL.exe 72 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1028 POL.exe 1028 POL.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1028 POL.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeImpersonatePrivilege 1340 POL.exe Token: SeTcbPrivilege 1340 POL.exe Token: SeChangeNotifyPrivilege 1340 POL.exe Token: SeCreateTokenPrivilege 1340 POL.exe Token: SeBackupPrivilege 1340 POL.exe Token: SeRestorePrivilege 1340 POL.exe Token: SeIncreaseQuotaPrivilege 1340 POL.exe Token: SeAssignPrimaryTokenPrivilege 1340 POL.exe Token: SeImpersonatePrivilege 1340 POL.exe Token: SeTcbPrivilege 1340 POL.exe Token: SeChangeNotifyPrivilege 1340 POL.exe Token: SeCreateTokenPrivilege 1340 POL.exe Token: SeBackupPrivilege 1340 POL.exe Token: SeRestorePrivilege 1340 POL.exe Token: SeIncreaseQuotaPrivilege 1340 POL.exe Token: SeAssignPrimaryTokenPrivilege 1340 POL.exe Token: SeImpersonatePrivilege 1340 POL.exe Token: SeTcbPrivilege 1340 POL.exe Token: SeChangeNotifyPrivilege 1340 POL.exe Token: SeCreateTokenPrivilege 1340 POL.exe Token: SeBackupPrivilege 1340 POL.exe Token: SeRestorePrivilege 1340 POL.exe Token: SeIncreaseQuotaPrivilege 1340 POL.exe Token: SeAssignPrimaryTokenPrivilege 1340 POL.exe Token: SeImpersonatePrivilege 1340 POL.exe Token: SeTcbPrivilege 1340 POL.exe Token: SeChangeNotifyPrivilege 1340 POL.exe Token: SeCreateTokenPrivilege 1340 POL.exe Token: SeBackupPrivilege 1340 POL.exe Token: SeRestorePrivilege 1340 POL.exe Token: SeIncreaseQuotaPrivilege 1340 POL.exe Token: SeAssignPrimaryTokenPrivilege 1340 POL.exe Token: SeImpersonatePrivilege 1340 POL.exe Token: SeTcbPrivilege 1340 POL.exe Token: SeChangeNotifyPrivilege 1340 POL.exe Token: SeCreateTokenPrivilege 1340 POL.exe Token: SeBackupPrivilege 1340 POL.exe Token: SeRestorePrivilege 1340 POL.exe Token: SeIncreaseQuotaPrivilege 1340 POL.exe Token: SeAssignPrimaryTokenPrivilege 1340 POL.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1028 wrote to memory of 1340 1028 POL.exe 72 PID 1028 wrote to memory of 1340 1028 POL.exe 72 PID 1028 wrote to memory of 1340 1028 POL.exe 72 PID 1340 wrote to memory of 864 1340 POL.exe 77 PID 1340 wrote to memory of 864 1340 POL.exe 77 PID 1340 wrote to memory of 864 1340 POL.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\POL.exe"C:\Users\Admin\AppData\Local\Temp\POL.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\POL.exe"C:\Users\Admin\AppData\Local\Temp\POL.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259279234.bat" "C:\Users\Admin\AppData\Local\Temp\POL.exe" "3⤵PID:864
-
-