Analysis
- max time kernel
141s - max time network
184s - platform
windows7_x64 - resource
win7v20210408 - submitted
02/07/2021, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
C27703650690CAFF819FF9466EF6ACC5.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target C27703650690CAFF819FF9466EF6ACC5.exe
- Size 1.6MB
- Sample210702-ptr9m4c8tn
- SHA256 d700e68d1c067c7bb297805d8429aa95cde9b6ec484c490ebdb01fc9689b1a31
- MD5 c27703650690caff819ff9466ef6acc5
- SHA1 cde7a5fbea03414bccb57baddbc1b10c305c7e60
- SHA512 2f705395838d8cdaa4437f3a31065b9bfcaf7d78e5e3cbb28f9f555a1776e34900d8ad6d9e36aed5f14acc9e243022daf31a813328b9fea9f3fb133e9916c962
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1532 dwm.exe - Loads dropped DLL 2 IoCs
pid Process 1612 cmd.exe 1612 cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ipinfo.io 8 ipinfo.io - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\nlmsprep\dwm.exe C27703650690CAFF819FF9466EF6ACC5.exe File opened for modification C:\Windows\SysWOW64\nlmsprep\dwm.exe C27703650690CAFF819FF9466EF6ACC5.exe File created C:\Windows\SysWOW64\nlmsprep\6cb0b6c459d5d3455a3da700e713f2e2529862ff C27703650690CAFF819FF9466EF6ACC5.exe File created C:\Windows\SysWOW64\KBDINMAL\lsm.exe C27703650690CAFF819FF9466EF6ACC5.exe File created C:\Windows\SysWOW64\KBDINMAL\101b941d020240259ca4912829b53995ad543df6 C27703650690CAFF819FF9466EF6ACC5.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 1808 C27703650690CAFF819FF9466EF6ACC5.exe 1808 C27703650690CAFF819FF9466EF6ACC5.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe 1532 dwm.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\DtcInstall\7a0fd90576e08807bde2cc57bcf9854bbce05fe3 C27703650690CAFF819FF9466EF6ACC5.exe File created C:\Windows\Downloaded Program Files\Idle.exe C27703650690CAFF819FF9466EF6ACC5.exe File created C:\Windows\Downloaded Program Files\6ccacd8608530fba3a93e87ae2225c7032aa18c1 C27703650690CAFF819FF9466EF6ACC5.exe File created C:\Windows\Tasks\spoolsv.exe C27703650690CAFF819FF9466EF6ACC5.exe File created C:\Windows\Tasks\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4 C27703650690CAFF819FF9466EF6ACC5.exe File created C:\Windows\DtcInstall\explorer.exe C27703650690CAFF819FF9466EF6ACC5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 852 schtasks.exe 1584 schtasks.exe 532 schtasks.exe 1664 schtasks.exe 428 schtasks.exe 1292 schtasks.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1484 PING.EXE - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1808 C27703650690CAFF819FF9466EF6ACC5.exe 1532 dwm.exe 1532 dwm.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1532 dwm.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1808 C27703650690CAFF819FF9466EF6ACC5.exe Token: SeDebugPrivilege 1532 dwm.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1808 C27703650690CAFF819FF9466EF6ACC5.exe 1532 dwm.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1292 1808 C27703650690CAFF819FF9466EF6ACC5.exe 30 PID 1808 wrote to memory of 1292 1808 C27703650690CAFF819FF9466EF6ACC5.exe 30 PID 1808 wrote to memory of 1292 1808 C27703650690CAFF819FF9466EF6ACC5.exe 30 PID 1808 wrote to memory of 1292 1808 C27703650690CAFF819FF9466EF6ACC5.exe 30 PID 1808 wrote to memory of 852 1808 C27703650690CAFF819FF9466EF6ACC5.exe 32 PID 1808 wrote to memory of 852 1808 C27703650690CAFF819FF9466EF6ACC5.exe 32 PID 1808 wrote to memory of 852 1808 C27703650690CAFF819FF9466EF6ACC5.exe 32 PID 1808 wrote to memory of 852 1808 C27703650690CAFF819FF9466EF6ACC5.exe 32 PID 1808 wrote to memory of 1584 1808 C27703650690CAFF819FF9466EF6ACC5.exe 34 PID 1808 wrote to memory of 1584 1808 C27703650690CAFF819FF9466EF6ACC5.exe 34 PID 1808 wrote to memory of 1584 1808 C27703650690CAFF819FF9466EF6ACC5.exe 34 PID 1808 wrote to memory of 1584 1808 C27703650690CAFF819FF9466EF6ACC5.exe 34 PID 1808 wrote to memory of 532 1808 C27703650690CAFF819FF9466EF6ACC5.exe 36 PID 1808 wrote to memory of 532 1808 C27703650690CAFF819FF9466EF6ACC5.exe 36 PID 1808 wrote to memory of 532 1808 C27703650690CAFF819FF9466EF6ACC5.exe 36 PID 1808 wrote to memory of 532 1808 C27703650690CAFF819FF9466EF6ACC5.exe 36 PID 1808 wrote to memory of 1664 1808 C27703650690CAFF819FF9466EF6ACC5.exe 38 PID 1808 wrote to memory of 1664 1808 C27703650690CAFF819FF9466EF6ACC5.exe 38 PID 1808 wrote to memory of 1664 1808 C27703650690CAFF819FF9466EF6ACC5.exe 38 PID 1808 wrote to memory of 1664 1808 C27703650690CAFF819FF9466EF6ACC5.exe 38 PID 1808 wrote to memory of 428 1808 C27703650690CAFF819FF9466EF6ACC5.exe 40 PID 1808 wrote to memory of 428 1808 C27703650690CAFF819FF9466EF6ACC5.exe 40 PID 1808 wrote to memory of 428 1808 C27703650690CAFF819FF9466EF6ACC5.exe 40 PID 1808 wrote to memory of 428 1808 C27703650690CAFF819FF9466EF6ACC5.exe 40 PID 1808 wrote to memory of 1612 1808 C27703650690CAFF819FF9466EF6ACC5.exe 42 PID 1808 wrote to memory of 1612 1808 C27703650690CAFF819FF9466EF6ACC5.exe 42 PID 1808 wrote to memory of 1612 1808 C27703650690CAFF819FF9466EF6ACC5.exe 42 PID 1808 wrote to memory of 1612 1808 C27703650690CAFF819FF9466EF6ACC5.exe 42 PID 1612 wrote to memory of 1336 1612 cmd.exe 44 PID 1612 wrote to memory of 1336 1612 cmd.exe 44 PID 1612 wrote to memory of 1336 1612 cmd.exe 44 PID 1612 wrote to memory of 1336 1612 cmd.exe 44 PID 1612 wrote to memory of 1484 1612 cmd.exe 45 PID 1612 wrote to memory of 1484 1612 cmd.exe 45 PID 1612 wrote to memory of 1484 1612 cmd.exe 45 PID 1612 wrote to memory of 1484 1612 cmd.exe 45 PID 1612 wrote to memory of 1532 1612 cmd.exe 46 PID 1612 wrote to memory of 1532 1612 cmd.exe 46 PID 1612 wrote to memory of 1532 1612 cmd.exe 46 PID 1612 wrote to memory of 1532 1612 cmd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\C27703650690CAFF819FF9466EF6ACC5.exe"C:\Users\Admin\AppData\Local\Temp\C27703650690CAFF819FF9466EF6ACC5.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\nlmsprep\dwm.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1292
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\KBDINMAL\lsm.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:852
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\Idle.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1584
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\PerfLogs\Admin\lsass.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:532
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Tasks\spoolsv.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1664
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\DtcInstall\explorer.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:428
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\US68fu1uaT.bat"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:1336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost3⤵
- Runs ping.exe
PID:1484
-
-
C:\Windows\SysWOW64\nlmsprep\dwm.exe"C:\Windows\System32\nlmsprep\dwm.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1532
-
-