Overview

overview

9

Static

static

49fd52a3f3...71.exe

windows7_x64

8

49fd52a3f3...71.exe

windows10_x64

9

Analysis

  • max time kernel
    150s
  • max time network
    163s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    17-05-2021 11:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe

  • Size

    137KB

  • MD5

    9aa3cc9d7c641ea22cfa3e5233e13c94

  • SHA1

    1970f6c17567d56c3e7840fe33a6959dd887fca2

  • SHA256

    49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71

  • SHA512

    ef87881534199c3eac630883701b86ac21e6143a61b2224c39421b23bf5d9a59b8b1b868becf8632582451d709be46c944359bbd132b75ec9591a5382b098e0c

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 7 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
    evasion
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe
    "C:\Users\Admin\AppData\Local\Temp\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe
      "C:\Windows\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe" g g g o n e123
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\System32\cmd.exe
        /C taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:684
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1972
    • C:\Windows\System32\cmd.exe
      /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:996
      • C:\Windows\system32\PING.EXE
        ping localhost -n 3
        3⤵
        • Runs ping.exe
        PID:872

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe
    MD5

    9aa3cc9d7c641ea22cfa3e5233e13c94

    SHA1

    1970f6c17567d56c3e7840fe33a6959dd887fca2

    SHA256

    49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71

    SHA512

    ef87881534199c3eac630883701b86ac21e6143a61b2224c39421b23bf5d9a59b8b1b868becf8632582451d709be46c944359bbd132b75ec9591a5382b098e0c

    Download Submit
  • memory/684-65-0x0000000000000000-mapping.dmp
    Download
  • memory/872-64-0x0000000000000000-mapping.dmp
    Download
  • memory/996-62-0x0000000000000000-mapping.dmp
    Download
  • memory/1572-60-0x0000000000000000-mapping.dmp
    Download
  • memory/1972-66-0x0000000000000000-mapping.dmp
    Download
  • memory/2000-59-0x0000000075511000-0x0000000075513000-memory.dmp
    Filesize

    8KB

    Download