Analysis
-
max time kernel
90s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-01-2021 19:03
Static task
static1
Behavioral task
behavioral1
Sample
a22e658934911479aa3e867fbd6d07b6.exe
Resource
win7v20201028
General
-
Target
a22e658934911479aa3e867fbd6d07b6.exe
-
Size
505KB
-
MD5
a22e658934911479aa3e867fbd6d07b6
-
SHA1
620d97ef5a4122a47ce90bf1f3493bf818ccd7dd
-
SHA256
f0cd7710ff81d06494b7130e510dbdd80503aa290be1cc845f465c068301747c
-
SHA512
ce359d4e0f82836396859e05d7285495a4a6512a9d0c8b773936295f41a5d9d7f79ed6eb55ef90ae3d003a8afd51624382a7fce0ac8fd4e76e7a33eb6f3ae88e
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 ip-api.com -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
a22e658934911479aa3e867fbd6d07b6.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a22e658934911479aa3e867fbd6d07b6.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a22e658934911479aa3e867fbd6d07b6.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
a22e658934911479aa3e867fbd6d07b6.exepid process 816 a22e658934911479aa3e867fbd6d07b6.exe 816 a22e658934911479aa3e867fbd6d07b6.exe 816 a22e658934911479aa3e867fbd6d07b6.exe 816 a22e658934911479aa3e867fbd6d07b6.exe 816 a22e658934911479aa3e867fbd6d07b6.exe 816 a22e658934911479aa3e867fbd6d07b6.exe 816 a22e658934911479aa3e867fbd6d07b6.exe 816 a22e658934911479aa3e867fbd6d07b6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 2272 firefox.exe Token: SeDebugPrivilege 2272 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 2272 firefox.exe 2272 firefox.exe 2272 firefox.exe 2272 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 2272 firefox.exe 2272 firefox.exe 2272 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 2272 firefox.exe -
Suspicious use of WriteProcessMemory 140 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 516 wrote to memory of 2272 516 firefox.exe firefox.exe PID 516 wrote to memory of 2272 516 firefox.exe firefox.exe PID 516 wrote to memory of 2272 516 firefox.exe firefox.exe PID 516 wrote to memory of 2272 516 firefox.exe firefox.exe PID 516 wrote to memory of 2272 516 firefox.exe firefox.exe PID 516 wrote to memory of 2272 516 firefox.exe firefox.exe PID 516 wrote to memory of 2272 516 firefox.exe firefox.exe PID 516 wrote to memory of 2272 516 firefox.exe firefox.exe PID 516 wrote to memory of 2272 516 firefox.exe firefox.exe PID 2272 wrote to memory of 4032 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 4032 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 588 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1672 2272 firefox.exe firefox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22e658934911479aa3e867fbd6d07b6.exe"C:\Users\Admin\AppData\Local\Temp\a22e658934911479aa3e867fbd6d07b6.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:816
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.0.813215836\592347973" -parentBuildID 20200403170909 -prefsHandle 1528 -prefMapHandle 1492 -prefsLen 1 -prefMapSize 219631 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 1628 gpu3⤵PID:4032
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.3.765795524\1496517345" -childID 1 -isForBrowser -prefsHandle 2268 -prefMapHandle 2264 -prefsLen 156 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 2276 tab3⤵PID:588
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.13.1031593898\788780130" -childID 2 -isForBrowser -prefsHandle 3364 -prefMapHandle 2232 -prefsLen 7013 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 3376 tab3⤵PID:1672
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.20.1541393951\151048217" -childID 3 -isForBrowser -prefsHandle 4492 -prefMapHandle 4100 -prefsLen 7941 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 4432 tab3⤵PID:3392
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/588-8-0x0000000000000000-mapping.dmp
-
memory/816-2-0x0000000006A70000-0x0000000006A71000-memory.dmpFilesize
4KB
-
memory/816-3-0x0000000006A10000-0x0000000006A66000-memory.dmpFilesize
344KB
-
memory/816-4-0x0000000006A70000-0x0000000006AF9000-memory.dmpFilesize
548KB
-
memory/816-5-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1672-9-0x0000000000000000-mapping.dmp
-
memory/2272-6-0x0000000000000000-mapping.dmp
-
memory/3392-10-0x0000000000000000-mapping.dmp
-
memory/4032-7-0x0000000000000000-mapping.dmp