Analysis
- max time kernel
63s - max time network
125s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 16:04
General
- Target 323bf86aeeab08e1388d51cffc172f53.exe
- Size 207KB
- Sample201111-xefe85p4ds
- SHA256 2f40f4d8e5fd1aeb0510e07f954f0f22f6d0e6644bae21bfcd5b913696c158cb
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
- ServiceHost packer 4 IoCs
Detects ServiceHost packer used for .NET malware
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\323bf86aeeab08e1388d51cffc172f53.exe"C:\Users\Admin\AppData\Local\Temp\323bf86aeeab08e1388d51cffc172f53.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kibalJIj.exe"C:\Users\Admin\AppData\Local\Temp\kibalJIj.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 4003⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\kibalJIj.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\kibalJIj.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\kibalJIj.exeC:\Users\Admin\AppData\Local\Temp\kibalJIj.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 3482⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/916-0-0x00000000007E6000-0x00000000007E7000-memory.dmp
memory/916-1-0x0000000002210000-0x0000000002211000-memory.dmp
memory/1504-13-0x0000000005260000-0x0000000005261000-memory.dmp
memory/1504-8-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/2272-7-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/2864-16-0x0000000004760000-0x0000000004761000-memory.dmp
memory/2864-17-0x0000000004760000-0x0000000004761000-memory.dmp
memory/2864-19-0x0000000005020000-0x0000000005021000-memory.dmp
memory/2864-22-0x0000000005180000-0x0000000005181000-memory.dmp
memory/4036-15-0x00000000009B0000-0x00000000009B1000-memory.dmp