Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-03-2021 08:21
Static task
static1
Behavioral task
behavioral1
Sample
c481259ad199b773339f168902cc7437.exe
Resource
win7v20201028
General
-
Target
c481259ad199b773339f168902cc7437.exe
-
Size
267KB
-
MD5
c481259ad199b773339f168902cc7437
-
SHA1
4c9a81f2a9167f953109eddbd141ea8d078d13e9
-
SHA256
1da5a6aac7197d1fcadef018775831885b715d5c37a3115777dc5c717ce6e0da
-
SHA512
5bc8965e9aa550f3e37b312f3d4a6854b0002f42b5a111087a754e3ed7cdcf957b40f6bebc389b405317b46eeaed88132545732daac74723945591ae38cdcabf
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.ipify.org 13 ip-api.com 9 api.ipify.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
c481259ad199b773339f168902cc7437.exepid process 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c481259ad199b773339f168902cc7437.exedescription pid process target process PID 1616 set thread context of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1532 1616 WerFault.exe c481259ad199b773339f168902cc7437.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1600 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c481259ad199b773339f168902cc7437.exeWerFault.exec481259ad199b773339f168902cc7437.exepid process 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1616 c481259ad199b773339f168902cc7437.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe 316 c481259ad199b773339f168902cc7437.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
c481259ad199b773339f168902cc7437.exeWerFault.exec481259ad199b773339f168902cc7437.exedescription pid process Token: SeDebugPrivilege 1616 c481259ad199b773339f168902cc7437.exe Token: SeDebugPrivilege 1532 WerFault.exe Token: SeDebugPrivilege 316 c481259ad199b773339f168902cc7437.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
c481259ad199b773339f168902cc7437.execmd.exedescription pid process target process PID 1616 wrote to memory of 1368 1616 c481259ad199b773339f168902cc7437.exe cmd.exe PID 1616 wrote to memory of 1368 1616 c481259ad199b773339f168902cc7437.exe cmd.exe PID 1616 wrote to memory of 1368 1616 c481259ad199b773339f168902cc7437.exe cmd.exe PID 1616 wrote to memory of 1368 1616 c481259ad199b773339f168902cc7437.exe cmd.exe PID 1368 wrote to memory of 1600 1368 cmd.exe timeout.exe PID 1368 wrote to memory of 1600 1368 cmd.exe timeout.exe PID 1368 wrote to memory of 1600 1368 cmd.exe timeout.exe PID 1368 wrote to memory of 1600 1368 cmd.exe timeout.exe PID 1616 wrote to memory of 1636 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 1636 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 1636 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 1636 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 1660 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 1660 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 1660 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 1660 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 316 1616 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe PID 1616 wrote to memory of 1532 1616 c481259ad199b773339f168902cc7437.exe WerFault.exe PID 1616 wrote to memory of 1532 1616 c481259ad199b773339f168902cc7437.exe WerFault.exe PID 1616 wrote to memory of 1532 1616 c481259ad199b773339f168902cc7437.exe WerFault.exe PID 1616 wrote to memory of 1532 1616 c481259ad199b773339f168902cc7437.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1600
-
-
-
C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"2⤵PID:1636
-
-
C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"2⤵PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 18082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-