Analysis
-
max time kernel
15s -
max time network
111s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-01-2021 16:22
Static task
static1
Behavioral task
behavioral1
Sample
02_extracted.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
02_extracted.exe
Resource
win10v20201028
General
-
Target
02_extracted.exe
-
Size
512KB
-
MD5
299e51e32a764ec12716fa4f5ee41fb0
-
SHA1
71c0a42ae41a86e0f6f8a1d11a358be80a9ac72b
-
SHA256
658553ecc9631400e23f4a3ab88b8dd1f101a1e0d5bb61c434d332878a52c64d
-
SHA512
b6d57a4915447dc2d2bfc1368f9edbfb0fd8d37ab8395f9d5e9507bbc78f93a61bb597afdd6aa051256d8b80884c5fd29cb4bb6791d62bc3b4aa035a4e2395bb
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
02_extracted.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\International\Geo\Nation 02_extracted.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
02_extracted.exepid process 1640 02_extracted.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
02_extracted.exepowershell.exepid process 1640 02_extracted.exe 1640 02_extracted.exe 1640 02_extracted.exe 1640 02_extracted.exe 1092 powershell.exe 1092 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
02_extracted.exepowershell.exedescription pid process Token: SeDebugPrivilege 1640 02_extracted.exe Token: SeDebugPrivilege 1092 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
02_extracted.exepid process 1640 02_extracted.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
02_extracted.exedescription pid process target process PID 1640 wrote to memory of 1092 1640 02_extracted.exe powershell.exe PID 1640 wrote to memory of 1092 1640 02_extracted.exe powershell.exe PID 1640 wrote to memory of 1092 1640 02_extracted.exe powershell.exe PID 1640 wrote to memory of 1092 1640 02_extracted.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02_extracted.exe"C:\Users\Admin\AppData\Local\Temp\02_extracted.exe"1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\02_extracted.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1092-9-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/1092-13-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/1092-5-0x0000000000000000-mapping.dmp
-
memory/1092-6-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/1092-7-0x0000000002100000-0x0000000002101000-memory.dmpFilesize
4KB
-
memory/1092-8-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/1092-42-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1092-10-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1092-41-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/1092-18-0x0000000006080000-0x0000000006081000-memory.dmpFilesize
4KB
-
memory/1092-19-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/1092-26-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1092-27-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/1640-2-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/1640-3-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB