Analysis
- max time kernel
20s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:43
Static task
static1
Behavioral task
behavioral1
Sample
PO200200017-2494.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target PO200200017-2494.exe
- Size 270KB
- Sample201109-x116am71n2
- SHA256 ebadbebdb632cdc59b9333f56295ea99080248807a1d6f35c086159c8b2329e6
- MD5 d39da7377015f8a81f92344c28072b6f
- SHA1 b5dabdb3085c89a2e0e2806fa350a6a6423639c9
- SHA512 326b01b97faa2e1b4f623c8074864085dc7804473e3eed8ad74bb57ad783a764f4372c24572a2d480f7ebd326203f52714273694993d79e719c60b28a507f7e6
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3372 set thread context of 3264 3372 PO200200017-2494.exe 75 - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeImpersonatePrivilege 3264 PO200200017-2494.exe Token: SeTcbPrivilege 3264 PO200200017-2494.exe Token: SeChangeNotifyPrivilege 3264 PO200200017-2494.exe Token: SeCreateTokenPrivilege 3264 PO200200017-2494.exe Token: SeBackupPrivilege 3264 PO200200017-2494.exe Token: SeRestorePrivilege 3264 PO200200017-2494.exe Token: SeIncreaseQuotaPrivilege 3264 PO200200017-2494.exe Token: SeAssignPrimaryTokenPrivilege 3264 PO200200017-2494.exe Token: SeImpersonatePrivilege 3264 PO200200017-2494.exe Token: SeTcbPrivilege 3264 PO200200017-2494.exe Token: SeChangeNotifyPrivilege 3264 PO200200017-2494.exe Token: SeCreateTokenPrivilege 3264 PO200200017-2494.exe Token: SeBackupPrivilege 3264 PO200200017-2494.exe Token: SeRestorePrivilege 3264 PO200200017-2494.exe Token: SeIncreaseQuotaPrivilege 3264 PO200200017-2494.exe Token: SeAssignPrimaryTokenPrivilege 3264 PO200200017-2494.exe Token: SeImpersonatePrivilege 3264 PO200200017-2494.exe Token: SeTcbPrivilege 3264 PO200200017-2494.exe Token: SeChangeNotifyPrivilege 3264 PO200200017-2494.exe Token: SeCreateTokenPrivilege 3264 PO200200017-2494.exe Token: SeBackupPrivilege 3264 PO200200017-2494.exe Token: SeRestorePrivilege 3264 PO200200017-2494.exe Token: SeIncreaseQuotaPrivilege 3264 PO200200017-2494.exe Token: SeAssignPrimaryTokenPrivilege 3264 PO200200017-2494.exe Token: SeImpersonatePrivilege 3264 PO200200017-2494.exe Token: SeTcbPrivilege 3264 PO200200017-2494.exe Token: SeChangeNotifyPrivilege 3264 PO200200017-2494.exe Token: SeCreateTokenPrivilege 3264 PO200200017-2494.exe Token: SeBackupPrivilege 3264 PO200200017-2494.exe Token: SeRestorePrivilege 3264 PO200200017-2494.exe Token: SeIncreaseQuotaPrivilege 3264 PO200200017-2494.exe Token: SeAssignPrimaryTokenPrivilege 3264 PO200200017-2494.exe Token: SeImpersonatePrivilege 3264 PO200200017-2494.exe Token: SeTcbPrivilege 3264 PO200200017-2494.exe Token: SeChangeNotifyPrivilege 3264 PO200200017-2494.exe Token: SeCreateTokenPrivilege 3264 PO200200017-2494.exe Token: SeBackupPrivilege 3264 PO200200017-2494.exe Token: SeRestorePrivilege 3264 PO200200017-2494.exe Token: SeIncreaseQuotaPrivilege 3264 PO200200017-2494.exe Token: SeAssignPrimaryTokenPrivilege 3264 PO200200017-2494.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3372 wrote to memory of 3264 3372 PO200200017-2494.exe 75 PID 3372 wrote to memory of 3264 3372 PO200200017-2494.exe 75 PID 3372 wrote to memory of 3264 3372 PO200200017-2494.exe 75 PID 3372 wrote to memory of 3264 3372 PO200200017-2494.exe 75 PID 3372 wrote to memory of 3264 3372 PO200200017-2494.exe 75 PID 3372 wrote to memory of 3264 3372 PO200200017-2494.exe 75 PID 3372 wrote to memory of 3264 3372 PO200200017-2494.exe 75 PID 3372 wrote to memory of 3264 3372 PO200200017-2494.exe 75 PID 3264 wrote to memory of 3356 3264 PO200200017-2494.exe 76 PID 3264 wrote to memory of 3356 3264 PO200200017-2494.exe 76 PID 3264 wrote to memory of 3356 3264 PO200200017-2494.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO200200017-2494.exe"C:\Users\Admin\AppData\Local\Temp\PO200200017-2494.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\PO200200017-2494.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259288140.bat" "C:\Users\Admin\AppData\Local\Temp\PO200200017-2494.exe" "3⤵PID:3356
-
-