bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c

Analysis

max time kernel
159s
max time network
155s
platform
windows10_x64
resource
win10v20201028
submitted
28/02/2021, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
Size 1.2MB
Sample210228-sw4shm381x
SHA256 bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c
MD5 29d013989caeabb06a79e340f659e910
SHA1 4a27bb55221a74e8942bf5e2256eb498ef4cb48d
SHA512 b0d080e7e30ada11e2b244f2ca693be77f4ecd4afd2e262ce5fa949ce78b09b09d76de0aacf180431d7998d775865ee4f85cc3d057d0f5adfd7ca537991c3d4c
MD5 SHA1 SHA512

Score

8^/10

spyware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3544	csrss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	ipinfo.io
23	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

pid	Process
504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\en-US\886983d96e3d3e31032c679b2d4ea91b6c05afef	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\sihost.exe	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\sihost.exe	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\csrss.exe	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3664	schtasks.exe
2760	schtasks.exe
2892	schtasks.exe
940	schtasks.exe
4080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
3544	csrss.exe
3544	csrss.exe
3544	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
Token: SeDebugPrivilege	3544	csrss.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
3544	csrss.exe
3544	csrss.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 3664	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	75
PID 504 wrote to memory of 3664	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	75
PID 504 wrote to memory of 3664	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	75
PID 504 wrote to memory of 2760	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	77
PID 504 wrote to memory of 2760	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	77
PID 504 wrote to memory of 2760	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	77
PID 504 wrote to memory of 2892	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	79
PID 504 wrote to memory of 2892	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	79
PID 504 wrote to memory of 2892	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	79
PID 504 wrote to memory of 940	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	81
PID 504 wrote to memory of 940	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	81
PID 504 wrote to memory of 940	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	81
PID 504 wrote to memory of 4080	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	83
PID 504 wrote to memory of 4080	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	83
PID 504 wrote to memory of 4080	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	83
PID 504 wrote to memory of 3544	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	85
PID 504 wrote to memory of 3544	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	85
PID 504 wrote to memory of 3544	504	bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe	85

C:\Users\Admin\AppData\Local\Temp\bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe
"C:\Users\Admin\AppData\Local\Temp\bd15b8dc3c9eeddcc7e33877876fb0d3856495b473df950f50bec4701db73d5c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:504
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\sihost.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3664
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\odt\WMIADAP.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2760
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2892
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:940
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\csrss.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:4080
- C:\Program Files\Windows Photo Viewer\en-US\csrss.exe
  "C:\Program Files\Windows Photo Viewer\en-US\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-9-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Download

memory/504-4-0x0000000073C20000-0x000000007430E000-memory.dmp

Download

memory/504-8-0x0000000005C60000-0x0000000005C61000-memory.dmp

Download

memory/504-2-0x00000000037B0000-0x00000000037B1000-memory.dmp

Download

memory/504-10-0x00000000068A0000-0x00000000068A1000-memory.dmp

Download

memory/504-11-0x00000000069E0000-0x00000000069E1000-memory.dmp

Download

memory/504-7-0x00000000060C0000-0x00000000060C1000-memory.dmp

Download

memory/504-5-0x00000000000E0000-0x00000000000E1000-memory.dmp

Download

memory/3544-20-0x0000000003A50000-0x0000000003A51000-memory.dmp

Download

memory/3544-22-0x0000000073C20000-0x000000007430E000-memory.dmp

Download

memory/3544-23-0x0000000001200000-0x0000000001201000-memory.dmp

Download

memory/3544-27-0x0000000006001000-0x0000000006002000-memory.dmp

Download

memory/3544-30-0x00000000078B0000-0x00000000078B1000-memory.dmp

Download

memory/3544-31-0x0000000007B60000-0x0000000007B61000-memory.dmp

Download