Analysis
-
max time kernel
118s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-12-2020 05:22
Static task
static1
Behavioral task
behavioral1
Sample
376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe
Resource
win10v20201028
General
-
Target
376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe
-
Size
373KB
-
MD5
a3701be6d0583d2f351a11cfac483623
-
SHA1
18b378083bdd67452a64bdb93c6a9a5a20770cc2
-
SHA256
376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e
-
SHA512
22932982cacf44414e1dadf20f999aa8183022f7dbcca6cb22afe64514452ab4d01fd758c54ed9b58e9c55e32778cd300da19d9419572795d912bfe3e3fc7c24
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
audiprov.exeaudiprov.exepid process 1664 audiprov.exe 408 audiprov.exe -
Deletes itself 1 IoCs
Processes:
audiprov.exepid process 408 audiprov.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exeaudiprov.exepid process 1116 cmd.exe 1116 cmd.exe 1664 audiprov.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\bcrydPnp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Cryputil\\audiprov.exe" 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exeaudiprov.exeaudiprov.exesvchost.exedescription pid process target process PID 2024 set thread context of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 1664 set thread context of 408 1664 audiprov.exe audiprov.exe PID 408 set thread context of 552 408 audiprov.exe svchost.exe PID 552 set thread context of 1268 552 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
audiprov.exeExplorer.EXEpid process 408 audiprov.exe 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
audiprov.exesvchost.exepid process 408 audiprov.exe 552 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.execmd.execmd.exeaudiprov.exeaudiprov.exesvchost.exeExplorer.EXEcmd.exedescription pid process target process PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 2024 wrote to memory of 1748 2024 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe PID 1748 wrote to memory of 1220 1748 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe cmd.exe PID 1748 wrote to memory of 1220 1748 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe cmd.exe PID 1748 wrote to memory of 1220 1748 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe cmd.exe PID 1748 wrote to memory of 1220 1748 376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe cmd.exe PID 1220 wrote to memory of 1116 1220 cmd.exe cmd.exe PID 1220 wrote to memory of 1116 1220 cmd.exe cmd.exe PID 1220 wrote to memory of 1116 1220 cmd.exe cmd.exe PID 1220 wrote to memory of 1116 1220 cmd.exe cmd.exe PID 1116 wrote to memory of 1664 1116 cmd.exe audiprov.exe PID 1116 wrote to memory of 1664 1116 cmd.exe audiprov.exe PID 1116 wrote to memory of 1664 1116 cmd.exe audiprov.exe PID 1116 wrote to memory of 1664 1116 cmd.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 1664 wrote to memory of 408 1664 audiprov.exe audiprov.exe PID 408 wrote to memory of 552 408 audiprov.exe svchost.exe PID 408 wrote to memory of 552 408 audiprov.exe svchost.exe PID 408 wrote to memory of 552 408 audiprov.exe svchost.exe PID 408 wrote to memory of 552 408 audiprov.exe svchost.exe PID 408 wrote to memory of 552 408 audiprov.exe svchost.exe PID 408 wrote to memory of 552 408 audiprov.exe svchost.exe PID 408 wrote to memory of 552 408 audiprov.exe svchost.exe PID 552 wrote to memory of 1268 552 svchost.exe Explorer.EXE PID 552 wrote to memory of 1268 552 svchost.exe Explorer.EXE PID 552 wrote to memory of 1268 552 svchost.exe Explorer.EXE PID 1268 wrote to memory of 1096 1268 Explorer.EXE cmd.exe PID 1268 wrote to memory of 1096 1268 Explorer.EXE cmd.exe PID 1268 wrote to memory of 1096 1268 Explorer.EXE cmd.exe PID 1096 wrote to memory of 1328 1096 cmd.exe nslookup.exe PID 1096 wrote to memory of 1328 1096 cmd.exe nslookup.exe PID 1096 wrote to memory of 1328 1096 cmd.exe nslookup.exe PID 1268 wrote to memory of 1660 1268 Explorer.EXE cmd.exe PID 1268 wrote to memory of 1660 1268 Explorer.EXE cmd.exe PID 1268 wrote to memory of 1660 1268 Explorer.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe"C:\Users\Admin\AppData\Local\Temp\376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe"C:\Users\Admin\AppData\Local\Temp\376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8B3F\21.bat" "C:\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exe" "C:\Users\Admin\AppData\Local\Temp\376ECE~1.EXE""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exe" "C:\Users\Admin\AppData\Local\Temp\376ECE~1.EXE""5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exe"C:\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exe" "C:\Users\Admin\AppData\Local\Temp\376ECE~1.EXE"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exe"C:\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exe" "C:\Users\Admin\AppData\Local\Temp\376ECE~1.EXE"7⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\6B20.bi1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\6B20.bi1"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6B20.bi1MD5
c4f77466fa6bb3b7b587745fd51eb73e
SHA1c9ee49b895e2cec4483b9e3d84e32f0d650edcbb
SHA25637d5f9a9a4db772e5bcc6a0211a3092049c09f438067bc36cde152e10b79eeb8
SHA51251c1ddeac48567d106cbcc5bad19b31639b73ec66d11ed83dbc90da880792df0b6bd6c6e28a712e854ceeb6bd96a3985e521cb9d666b0ccd087e96f4a90fc7d7
-
C:\Users\Admin\AppData\Local\Temp\6B20.bi1MD5
c4f77466fa6bb3b7b587745fd51eb73e
SHA1c9ee49b895e2cec4483b9e3d84e32f0d650edcbb
SHA25637d5f9a9a4db772e5bcc6a0211a3092049c09f438067bc36cde152e10b79eeb8
SHA51251c1ddeac48567d106cbcc5bad19b31639b73ec66d11ed83dbc90da880792df0b6bd6c6e28a712e854ceeb6bd96a3985e521cb9d666b0ccd087e96f4a90fc7d7
-
C:\Users\Admin\AppData\Local\Temp\8B3F\21.batMD5
3b5932a1f627a49431108ab13dd56faf
SHA1660160b1016e4f819e7b8e2ff65698929a3848a7
SHA256e0099b38f946be5aa5379661b9e162f0abd16bcce776374981ec70116d09f59c
SHA51202d00c988abc595eed0edebb3b8e6af268999316487677b011a4ba23b706eb945394d8ae09ef6cb8a0a5b5690b81f95af44b9bcc7a5d8763afb95550e04e48ab
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exeMD5
a3701be6d0583d2f351a11cfac483623
SHA118b378083bdd67452a64bdb93c6a9a5a20770cc2
SHA256376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e
SHA51222932982cacf44414e1dadf20f999aa8183022f7dbcca6cb22afe64514452ab4d01fd758c54ed9b58e9c55e32778cd300da19d9419572795d912bfe3e3fc7c24
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exeMD5
a3701be6d0583d2f351a11cfac483623
SHA118b378083bdd67452a64bdb93c6a9a5a20770cc2
SHA256376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e
SHA51222932982cacf44414e1dadf20f999aa8183022f7dbcca6cb22afe64514452ab4d01fd758c54ed9b58e9c55e32778cd300da19d9419572795d912bfe3e3fc7c24
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exeMD5
a3701be6d0583d2f351a11cfac483623
SHA118b378083bdd67452a64bdb93c6a9a5a20770cc2
SHA256376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e
SHA51222932982cacf44414e1dadf20f999aa8183022f7dbcca6cb22afe64514452ab4d01fd758c54ed9b58e9c55e32778cd300da19d9419572795d912bfe3e3fc7c24
-
\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exeMD5
a3701be6d0583d2f351a11cfac483623
SHA118b378083bdd67452a64bdb93c6a9a5a20770cc2
SHA256376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e
SHA51222932982cacf44414e1dadf20f999aa8183022f7dbcca6cb22afe64514452ab4d01fd758c54ed9b58e9c55e32778cd300da19d9419572795d912bfe3e3fc7c24
-
\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exeMD5
a3701be6d0583d2f351a11cfac483623
SHA118b378083bdd67452a64bdb93c6a9a5a20770cc2
SHA256376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e
SHA51222932982cacf44414e1dadf20f999aa8183022f7dbcca6cb22afe64514452ab4d01fd758c54ed9b58e9c55e32778cd300da19d9419572795d912bfe3e3fc7c24
-
\Users\Admin\AppData\Roaming\MICROS~1\Cryputil\audiprov.exeMD5
a3701be6d0583d2f351a11cfac483623
SHA118b378083bdd67452a64bdb93c6a9a5a20770cc2
SHA256376eceec074e00eed57561743299ce349d4305fd6829f02ae7c578ecdae59d7e
SHA51222932982cacf44414e1dadf20f999aa8183022f7dbcca6cb22afe64514452ab4d01fd758c54ed9b58e9c55e32778cd300da19d9419572795d912bfe3e3fc7c24
-
memory/408-17-0x0000000000401000-mapping.dmp
-
memory/408-21-0x0000000001CA0000-0x0000000001D32000-memory.dmpFilesize
584KB
-
memory/552-20-0x0000000000000000-mapping.dmp
-
memory/552-24-0x0000000000220000-0x00000000002B2000-memory.dmpFilesize
584KB
-
memory/552-23-0x00000000000D0000-0x0000000000106000-memory.dmpFilesize
216KB
-
memory/552-22-0x000007FFFFFD5000-mapping.dmp
-
memory/1096-473-0x0000000000000000-mapping.dmp
-
memory/1116-8-0x0000000000000000-mapping.dmp
-
memory/1220-6-0x0000000000000000-mapping.dmp
-
memory/1268-251-0x0000000007E80000-0x0000000007E91000-memory.dmpFilesize
68KB
-
memory/1268-25-0x0000000007E80000-0x0000000007E91000-memory.dmpFilesize
68KB
-
memory/1268-26-0x0000000008290000-0x00000000082A1000-memory.dmpFilesize
68KB
-
memory/1268-27-0x0000000007E80000-0x0000000007E91000-memory.dmpFilesize
68KB
-
memory/1328-474-0x0000000000000000-mapping.dmp
-
memory/1660-475-0x0000000000000000-mapping.dmp
-
memory/1664-14-0x000000000062F000-0x0000000000630000-memory.dmpFilesize
4KB
-
memory/1664-12-0x0000000000000000-mapping.dmp
-
memory/1748-5-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1748-4-0x0000000000401000-mapping.dmp
-
memory/1748-3-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2024-2-0x000000000030F000-0x0000000000310000-memory.dmpFilesize
4KB