Analysis
-
max time kernel
65s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-03-2021 17:26
Static task
static1
Behavioral task
behavioral1
Sample
updatewin.exe
Resource
win7v20201028
0 signatures
0 seconds
General
-
Target
updatewin.exe
-
Size
208KB
-
MD5
9010fa92cc83afe00fab38703e6ffa77
-
SHA1
4d603ec27d02d84a65d1555c2df0896d7675fafc
-
SHA256
38e6f4d8f53e8a38950594d9588cb00218bf46113c51b5241771181a521b9c75
-
SHA512
a39ea249da189fedd5f8d1c13d03693626c70ba08c69c4ec76396d3475c5480e98c8dba1da0b74089252d8d781fc050e4eed9346b648ccbb42e22cf6d15399e8
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Delays execution with timeout.exe 1 IoCs
pid Process 60 timeout.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2920 1048 updatewin.exe 76 PID 1048 wrote to memory of 2920 1048 updatewin.exe 76 PID 1048 wrote to memory of 2920 1048 updatewin.exe 76 PID 2920 wrote to memory of 60 2920 cmd.exe 78 PID 2920 wrote to memory of 60 2920 cmd.exe 78 PID 2920 wrote to memory of 60 2920 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\updatewin.exe"C:\Users\Admin\AppData\Local\Temp\updatewin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\updatewin.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
PID:60
-
-