Overview

overview

8

Static

static

sample.exe

windows7_x64

7

sample.exe

windows10_x64

8

Resubmissions

04/11/2022, 23:59

221104-31zxvacbc3 8

24/12/2020, 17:30

201224-s43rdxvlqn 8

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    24/12/2020, 17:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sample.exe

  • Size

    26KB

  • MD5

    c7cfaca6501361febe27a6b3e66a61bf

  • SHA1

    55a3414b9668596e120139a059db91a306281dcc

  • SHA256

    fd32cec288cec4f16dc5430cf86dc17e1d4cf941d635979fc17a59c8d6d83d44

  • SHA512

    490814ad45e81ca6712c179fc6f9849788da1e379a02597136a52cc8695d895b648676f1ae2ee200effdac0f0dac7d56bef0af3b6854c8c150f33120af4d75a1

Score
7/10
persistencespyware

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • JavaScript code in executable 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 196 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 218 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 279 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sample.exe
    "C:\Users\Admin\AppData\Local\Temp\sample.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://primearea.biz/product/235093/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1220

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/932-2-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/932-3-0x00000000009E0000-0x00000000009E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1764-6-0x000007FEF61A0000-0x000007FEF641A000-memory.dmp

    Filesize

    2.5MB

    Download