Analysis
- max time kernel
54s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
18/08/2021, 03:53
Static task
static1
Behavioral task
behavioral1
Sample
c2474e0bb1bd34461d6bb9400a0a67c1.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c2474e0bb1bd34461d6bb9400a0a67c1.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target c2474e0bb1bd34461d6bb9400a0a67c1.exe
- Size 351KB
- Sample210818-pg51gn9p6x
- SHA256 b56e7b2be2bb194db6e8e7c95e9477c49863e0eb8d2818f266f69e8e1a09647b
- MD5 c2474e0bb1bd34461d6bb9400a0a67c1
- SHA1 b57bbc6d45bb145204de0b68b2d59253734fbef7
- SHA512 6c9c8976b57c3af3c2a6697edbb9bb3772cc0702f20bb42b874c589968c2fdb5ef9fbf8650da2443847aec1aa50c97743ba906263f2af1cfe2684694196c5aae
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" c2474e0bb1bd34461d6bb9400a0a67c1.exe - Executes dropped EXE 2 IoCs
pid Process 3660 c2474e0bb1bd34461d6bb9400a0a67c1.exe 3032 c2474e0bb1bd34461d6bb9400a0a67c1.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3660 set thread context of 3032 3660 c2474e0bb1bd34461d6bb9400a0a67c1.exe 77 - Drops file in Program Files directory 55 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Temp\GUM18A1.tmp\GOFB2B~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe c2474e0bb1bd34461d6bb9400a0a67c1.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com c2474e0bb1bd34461d6bb9400a0a67c1.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" c2474e0bb1bd34461d6bb9400a0a67c1.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3032 c2474e0bb1bd34461d6bb9400a0a67c1.exe 3032 c2474e0bb1bd34461d6bb9400a0a67c1.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3660 c2474e0bb1bd34461d6bb9400a0a67c1.exe 3660 c2474e0bb1bd34461d6bb9400a0a67c1.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 636 wrote to memory of 3660 636 c2474e0bb1bd34461d6bb9400a0a67c1.exe 75 PID 636 wrote to memory of 3660 636 c2474e0bb1bd34461d6bb9400a0a67c1.exe 75 PID 636 wrote to memory of 3660 636 c2474e0bb1bd34461d6bb9400a0a67c1.exe 75 PID 3660 wrote to memory of 3032 3660 c2474e0bb1bd34461d6bb9400a0a67c1.exe 77 PID 3660 wrote to memory of 3032 3660 c2474e0bb1bd34461d6bb9400a0a67c1.exe 77 PID 3660 wrote to memory of 3032 3660 c2474e0bb1bd34461d6bb9400a0a67c1.exe 77 PID 3660 wrote to memory of 3032 3660 c2474e0bb1bd34461d6bb9400a0a67c1.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2474e0bb1bd34461d6bb9400a0a67c1.exe"C:\Users\Admin\AppData\Local\Temp\c2474e0bb1bd34461d6bb9400a0a67c1.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\c2474e0bb1bd34461d6bb9400a0a67c1.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\c2474e0bb1bd34461d6bb9400a0a67c1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\c2474e0bb1bd34461d6bb9400a0a67c1.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\c2474e0bb1bd34461d6bb9400a0a67c1.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3032
-
-