Analysis
-
max time kernel
24s -
max time network
83s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
16-02-2021 14:19
Static task
static1
Behavioral task
behavioral1
Sample
6d0000.exe
Resource
win7v20201028
0 signatures
0 seconds
General
-
Target
6d0000.exe
-
Size
434KB
-
MD5
0450cf37e2dd4058563f73f6ca7940e5
-
SHA1
c7c0d5c274eadf534eea3203e6c026258144c68e
-
SHA256
da767e6faf97d73997f397eae71b372a549dd6331bf8ec0ebd398ef8cfe9a47e
-
SHA512
2d48fe05f18934808609d121e2dff8596016406002f221d90154903b09b40d409f805aba51ed8801ae572f20e1005fc104d83ead4b05eeab7ea39c8063a06ef3
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1904 GetX64BTIT.exe 3372 2075268060.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 api.ipify.org 10 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Program crash 1 IoCs
pid pid_target Process procid_target 380 4764 WerFault.exe 54 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 6d0000.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe 4764 6d0000.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 380 WerFault.exe Token: SeBackupPrivilege 380 WerFault.exe Token: SeDebugPrivilege 380 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4764 6d0000.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4764 wrote to memory of 1904 4764 6d0000.exe 74 PID 4764 wrote to memory of 1904 4764 6d0000.exe 74 PID 4764 wrote to memory of 3372 4764 6d0000.exe 80 PID 4764 wrote to memory of 3372 4764 6d0000.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d0000.exe"C:\Users\Admin\AppData\Local\Temp\6d0000.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\{7484BCA8-33F5-4FD1-9644-6F2CDBC0E606}\2075268060.exe"2075268060.exe"2⤵
- Executes dropped EXE
PID:3372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 11202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:380
-