Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:36
Static task
static1
Behavioral task
behavioral1
Sample
PO-5042.scr
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PO-5042.scr
Resource
win10v20201028
General
-
Target
PO-5042.scr
-
Size
1.5MB
-
MD5
f502ba6dcaa52430ff540dbdef13c40b
-
SHA1
b697dbbac2192c5416648413f0639e9da4763c9a
-
SHA256
b1251d0a542cd96f6957904d30289cbf675035ae79ac4158fc098aa84cd22506
-
SHA512
b8d1a484012238d7a0d49bbe2077231b2bc39cd0581bc8e41b8e24ff2fcc39580ed8cecafea2570acf1df9d3ee1eb713415c80d1af1735fc029fe696b19d5d81
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
explore.exeInstallUtil.exepid process 3740 explore.exe 3624 InstallUtil.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\explore = "C:\\Users\\Admin\\explore.exe" reg.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 checkip.dyndns.org 21 freegeoip.app 22 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
explore.exedescription pid process target process PID 3740 set thread context of 3624 3740 explore.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
PO-5042.screxplore.exeInstallUtil.exepid process 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3928 PO-5042.scr 3740 explore.exe 3740 explore.exe 3624 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO-5042.screxplore.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3928 PO-5042.scr Token: SeDebugPrivilege 3740 explore.exe Token: SeDebugPrivilege 3624 InstallUtil.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PO-5042.scrcmd.exeexplore.exedescription pid process target process PID 3928 wrote to memory of 192 3928 PO-5042.scr cmd.exe PID 3928 wrote to memory of 192 3928 PO-5042.scr cmd.exe PID 3928 wrote to memory of 192 3928 PO-5042.scr cmd.exe PID 192 wrote to memory of 2364 192 cmd.exe reg.exe PID 192 wrote to memory of 2364 192 cmd.exe reg.exe PID 192 wrote to memory of 2364 192 cmd.exe reg.exe PID 3928 wrote to memory of 3740 3928 PO-5042.scr explore.exe PID 3928 wrote to memory of 3740 3928 PO-5042.scr explore.exe PID 3928 wrote to memory of 3740 3928 PO-5042.scr explore.exe PID 3740 wrote to memory of 3624 3740 explore.exe InstallUtil.exe PID 3740 wrote to memory of 3624 3740 explore.exe InstallUtil.exe PID 3740 wrote to memory of 3624 3740 explore.exe InstallUtil.exe PID 3740 wrote to memory of 3624 3740 explore.exe InstallUtil.exe PID 3740 wrote to memory of 3624 3740 explore.exe InstallUtil.exe PID 3740 wrote to memory of 3624 3740 explore.exe InstallUtil.exe PID 3740 wrote to memory of 3624 3740 explore.exe InstallUtil.exe PID 3740 wrote to memory of 3624 3740 explore.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-5042.scr"C:\Users\Admin\AppData\Local\Temp\PO-5042.scr" /S1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "explore" /t REG_SZ /d "C:\Users\Admin\explore.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:192 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "explore" /t REG_SZ /d "C:\Users\Admin\explore.exe"3⤵
- Adds Run key to start application
PID:2364 -
C:\Users\Admin\explore.exe"C:\Users\Admin\explore.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
MD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
MD5
f502ba6dcaa52430ff540dbdef13c40b
SHA1b697dbbac2192c5416648413f0639e9da4763c9a
SHA256b1251d0a542cd96f6957904d30289cbf675035ae79ac4158fc098aa84cd22506
SHA512b8d1a484012238d7a0d49bbe2077231b2bc39cd0581bc8e41b8e24ff2fcc39580ed8cecafea2570acf1df9d3ee1eb713415c80d1af1735fc029fe696b19d5d81
-
MD5
f502ba6dcaa52430ff540dbdef13c40b
SHA1b697dbbac2192c5416648413f0639e9da4763c9a
SHA256b1251d0a542cd96f6957904d30289cbf675035ae79ac4158fc098aa84cd22506
SHA512b8d1a484012238d7a0d49bbe2077231b2bc39cd0581bc8e41b8e24ff2fcc39580ed8cecafea2570acf1df9d3ee1eb713415c80d1af1735fc029fe696b19d5d81