Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:26
General
-
Target
QRP-57843552.exe
-
Size
1.0MB
-
MD5
7da0fbd98ffd79125bc0373fe2e0c508
-
SHA1
97fbd05a865e216f1fba898602a15d9bb02b7e13
-
SHA256
c7ccb3ceba2173fcd6839e02a2e11abd7d32bd39b932ed74dcf389535be818f6
-
SHA512
85c32e69d9325933a17619ec30d538d8169401ec484c961c2280ef219caa0813889f538f680cfd2cdfd3d19f50c27d20333ec2e2b9cdd957e93e0e277fb18772
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QRP-57843552.exe"C:\Users\Admin\AppData\Local\Temp\QRP-57843552.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UWFDvz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp22BB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QRP-57843552.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QRP-57843552.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\tmp22BB.tmpMD5
00273509d9a4a0241b22dd09d54a677e
SHA10d2d7a7b61bd5f193400b394c3eeb0c8ce949d9b
SHA256555cd795c70b42bdcc8c9f32100350da7d12288df068163f43b49078d3cfa480
SHA512ec32da61eeb39eee8fc235842d38023cb8460204dfca201b98fe4e6a75e9ca33db22d52deffa3c979522b2b4ee9c881d2b13867ce6b7bbdc93db6f181bb52b5e
-
memory/1056-22-0x00000000060C0000-0x00000000060C1000-memory.dmpFilesize
4KB
-
memory/1056-21-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/1056-16-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1056-14-0x0000000000436D1E-mapping.dmp
-
memory/1056-13-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1344-7-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/1344-10-0x000000000A0C0000-0x000000000A0C1000-memory.dmpFilesize
4KB
-
memory/1344-9-0x00000000050F0000-0x0000000005176000-memory.dmpFilesize
536KB
-
memory/1344-8-0x0000000007D20000-0x0000000007D2E000-memory.dmpFilesize
56KB
-
memory/1344-2-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1344-6-0x0000000007B10000-0x0000000007B11000-memory.dmpFilesize
4KB
-
memory/1344-5-0x0000000008010000-0x0000000008011000-memory.dmpFilesize
4KB
-
memory/1344-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/2260-11-0x0000000000000000-mapping.dmp