Analysis
- max time kernel
63s - max time network
125s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 16:05
General
- Target 931fdd551975cf30ae02f85a90c5ee22.exe
- Size 215KB
- Sample201111-xt5bxz96ea
- SHA256 28af95bea8456409bdb09856b0f46304eff9801c3c841b1362ca7a794d7628a5
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
- ServiceHost packer 4 IoCs
Detects ServiceHost packer used for .NET malware
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\931fdd551975cf30ae02f85a90c5ee22.exe"C:\Users\Admin\AppData\Local\Temp\931fdd551975cf30ae02f85a90c5ee22.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gDichIeB.exe"C:\Users\Admin\AppData\Local\Temp\gDichIeB.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 4043⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\gDichIeB.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\gDichIeB.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\gDichIeB.exeC:\Users\Admin\AppData\Local\Temp\gDichIeB.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 5882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/672-1-0x0000000002320000-0x0000000002321000-memory.dmp
memory/672-0-0x00000000007D6000-0x00000000007D7000-memory.dmp
memory/1000-10-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/1000-15-0x0000000005210000-0x0000000005211000-memory.dmp
memory/2436-9-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/2576-17-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/3748-18-0x00000000048D0000-0x00000000048D1000-memory.dmp
memory/3748-19-0x00000000048D0000-0x00000000048D1000-memory.dmp
memory/3748-21-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/3748-25-0x0000000005350000-0x0000000005351000-memory.dmp