Analysis
-
max time kernel
129s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
04-05-2021 22:22
Static task
static1
Behavioral task
behavioral1
Sample
c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe
Resource
win7v20210408
General
-
Target
c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe
-
Size
1.7MB
-
MD5
5c31c43c0b069f40ca31ad8cad7d06f6
-
SHA1
60b8aa10f913c98307030fb899a36be2caf43b34
-
SHA256
c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba
-
SHA512
614226cb3202015e7c951eac41631b1192e8bcaa6a0b551011e6af803543d2d5631135b2ff6c753c6e63df17cca45c6adadff50fb58c1a2addbfbb1bded70faa
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exeDesktopLayer.exepid process 3652 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe 2416 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe upx C:\Users\Admin\AppData\Local\Temp\c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/3652-123-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe -
Drops file in Program Files directory 3 IoCs
Processes:
c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxAC3.tmp c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3976906529" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30884171" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3980501121" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30884171" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "326942181" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3976906529" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30884171" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30884171" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18017FF4-AD3F-11EB-A11C-D22FD1FF01E8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3980670912" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "326990767" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "326958775" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 2416 DesktopLayer.exe 2416 DesktopLayer.exe 2416 DesktopLayer.exe 2416 DesktopLayer.exe 2416 DesktopLayer.exe 2416 DesktopLayer.exe 2416 DesktopLayer.exe 2416 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 184 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exedescription pid process Token: SeManageVolumePrivilege 4024 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe Token: SeManageVolumePrivilege 4024 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 184 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exeiexplore.exeIEXPLORE.EXEpid process 4024 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe 4024 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe 4024 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe 4024 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe 184 iexplore.exe 184 iexplore.exe 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exec0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 4024 wrote to memory of 3652 4024 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe PID 4024 wrote to memory of 3652 4024 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe PID 4024 wrote to memory of 3652 4024 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe PID 3652 wrote to memory of 2416 3652 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe DesktopLayer.exe PID 3652 wrote to memory of 2416 3652 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe DesktopLayer.exe PID 3652 wrote to memory of 2416 3652 c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe DesktopLayer.exe PID 2416 wrote to memory of 184 2416 DesktopLayer.exe iexplore.exe PID 2416 wrote to memory of 184 2416 DesktopLayer.exe iexplore.exe PID 184 wrote to memory of 2020 184 iexplore.exe IEXPLORE.EXE PID 184 wrote to memory of 2020 184 iexplore.exe IEXPLORE.EXE PID 184 wrote to memory of 2020 184 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe"C:\Users\Admin\AppData\Local\Temp\c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cba.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exeC:\Users\Admin\AppData\Local\Temp\c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:184 CREDAT:82945 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
10987a1d727697d22e9613985bf39eba
SHA1d92fa559cdea14bdc068eb5388f4a8725d9d290c
SHA2568c026af272e0d8eae1ec8978047926e4bbdb2a7ebe0207a738307150e2ed0063
SHA51231910362ff1a6afe47a6abe7d77d1056eb1a1531cc027ae33bb34e1b4b788cd7efe2292278b02548e72b1441c86f85a3376ed46edf4c58a247febf4da91dfb87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
1e1c0dba38a2c6a0b1c71aae46ffdf24
SHA10c0bd94515f476d95273aad0c9c586a0dc3eafab
SHA2569f7ae2656a9120fbbcb0fd4e9d1131652a85b62d44e26a8f54eebec0a38b5db2
SHA5124fdd51f28e79b82902ff6b9440c11567e2aafda30a449d752459efe64c683203ebf10a25d49ac519d01fe86656cb639550c42078cf1685a0b091642b6d52da0f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\3AQVALFD.cookieMD5
2102f46774a45ba7cbac0a2c90fbcb70
SHA14e3b631db67215914df97b7f5ddeecec55660fb6
SHA256633957497a259bd5741572c4591df83c141f231c9fdaee72a4baa10b1b71039e
SHA5123ce96f3b0395ffc0c8b92b8300123d33b6bad18ff8c266e62e7ff39ece03ee4e987e74f257beaf604c1639e8a31c7c2dd83b685a9cfbcd1fad4c2d827a4915b7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\HQ7Y0DFX.cookieMD5
0dfd2d738c7d80cd0b07ff4fa3b292cf
SHA15150ceabf642151557a1c9bf264313d5eaf56213
SHA25638acfe68274f8271ca8683f1f6be60681bb41f605f7b56fa6063546ab9ee1e8d
SHA512281ed03606e0a5338904d9f62f7112a4724b4e31c71a5affc1bdbcc6454f6f99709636a9ab67524dedd1355d2523c228857d590f46f9fbe394f4478b16c1f088
-
C:\Users\Admin\AppData\Local\Temp\c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\c0ecde99a9fa77fc649aadeff683f2c7b800c81099de2c45eee6b85247c33cbaSrv.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
memory/184-121-0x0000000000000000-mapping.dmp
-
memory/184-126-0x00007FF9610D0000-0x00007FF96113B000-memory.dmpFilesize
428KB
-
memory/2020-127-0x0000000000000000-mapping.dmp
-
memory/2416-120-0x0000000000740000-0x0000000000741000-memory.dmpFilesize
4KB
-
memory/2416-117-0x0000000000000000-mapping.dmp
-
memory/3652-123-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3652-114-0x0000000000000000-mapping.dmp
-
memory/3652-122-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB