Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 20:15
Static task
static1
Behavioral task
behavioral1
Sample
sB2ppXd9nd1DsMC.exe
Resource
win7v20201028
General
-
Target
sB2ppXd9nd1DsMC.exe
-
Size
831KB
-
MD5
6471f431e11c4285b7ba8ac3c3e71ad9
-
SHA1
46f5265999242b24f5ff5cae831709b616a2c381
-
SHA256
b76e862dccd0da9b40dccf294bef402dc7a34185449bf55b022eb79dc8ce6e23
-
SHA512
095f5ed132db126a2f4571d3209fb697a609f75887d2a37a8630d5397f7422288d1903b2f21b62138be8644fe1fe9ca1c0537076a541fa9cecb1cb57779dd5f4
Malware Config
Extracted
remcos
185.244.26.241:1989
Signatures
-
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/280-15-0x0000000000476274-mapping.dmp WebBrowserPassView -
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral1/memory/280-15-0x0000000000476274-mapping.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
sB2ppXd9nd1DsMC.exesB2ppXd9nd1DsMC.exedescription pid process target process PID 1732 set thread context of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 set thread context of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 set thread context of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
sB2ppXd9nd1DsMC.exepid process 280 sB2ppXd9nd1DsMC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sB2ppXd9nd1DsMC.exedescription pid process Token: SeDebugPrivilege 996 sB2ppXd9nd1DsMC.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
sB2ppXd9nd1DsMC.exesB2ppXd9nd1DsMC.exedescription pid process target process PID 1732 wrote to memory of 1708 1732 sB2ppXd9nd1DsMC.exe schtasks.exe PID 1732 wrote to memory of 1708 1732 sB2ppXd9nd1DsMC.exe schtasks.exe PID 1732 wrote to memory of 1708 1732 sB2ppXd9nd1DsMC.exe schtasks.exe PID 1732 wrote to memory of 1708 1732 sB2ppXd9nd1DsMC.exe schtasks.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1732 wrote to memory of 1016 1732 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 2016 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 2016 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 2016 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 2016 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 280 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 996 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 436 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 436 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 436 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 1016 wrote to memory of 436 1016 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wShTcQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE994.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exeC:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe /stext "C:\Users\Admin\AppData\Local\Temp\btjvffp"3⤵
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exeC:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe /stext "C:\Users\Admin\AppData\Local\Temp\btjvffp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exeC:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe /stext "C:\Users\Admin\AppData\Local\Temp\dwofgyzwak"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exeC:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe /stext "C:\Users\Admin\AppData\Local\Temp\nqcyhqkxosmhiz"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE994.tmpMD5
8d8ac7df42305e6cb4ce97e3b9b635c6
SHA103f652d663b2fa5330b90c4ba27b19ce55d1e50c
SHA256571f2eba729d8670fcc3c2c84b1c1f2b8a375f3fe3e15fa32a5811bfd71d5743
SHA51210ffcdf580af4085b475bd708ec912275aa9eb64ec93a250cb0aa578681257c7aa253ac84793d564d554ae88ea3f4892acaba608a42d51202a5d1f964bead38e
-
memory/280-14-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/280-20-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/280-15-0x0000000000476274-mapping.dmp
-
memory/996-21-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/996-17-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/996-18-0x0000000000422206-mapping.dmp
-
memory/1016-11-0x0000000000413FA4-mapping.dmp
-
memory/1016-12-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1016-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1016-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1636-22-0x000007FEF6400000-0x000007FEF667A000-memory.dmpFilesize
2.5MB
-
memory/1708-8-0x0000000000000000-mapping.dmp
-
memory/1732-2-0x0000000074120000-0x000000007480E000-memory.dmpFilesize
6.9MB
-
memory/1732-7-0x0000000004C80000-0x0000000004CD9000-memory.dmpFilesize
356KB
-
memory/1732-6-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/1732-5-0x0000000002070000-0x0000000002093000-memory.dmpFilesize
140KB
-
memory/1732-3-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB