Resubmissions
29/11/2022, 17:56
221129-wjef9aeh811007/07/2022, 12:21
220707-pjry1sabg21017/11/2021, 18:12
211117-wtaaaaaebn21/08/2021, 14:02
210821-e56bctg12a8Analysis
- max time kernel
295s - max time network
314s - platform
windows10_x64 - resource
win10v20210410 - submitted
21/08/2021, 14:02
General
- Target 53e982e656f91d263494170d71228e6d98c026a23293fbb70176531794d149c0.exe
- Size 6.2MB
- Sample210821-e56bctg12a
- SHA256 53e982e656f91d263494170d71228e6d98c026a23293fbb70176531794d149c0
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- VMProtect packed file 9 IoCs
Detects executables packed with VMProtect commercial packer.
- Loads dropped DLL 5 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53e982e656f91d263494170d71228e6d98c026a23293fbb70176531794d149c0.exe"C:\Users\Admin\AppData\Local\Temp\53e982e656f91d263494170d71228e6d98c026a23293fbb70176531794d149c0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "powershell.exe -windowstyle hidden"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SpotifySetup1.exe"C:\Users\Admin\AppData\Local\Temp\SpotifySetup1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\SpotifySetup1.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe" Name host ValueOnly True2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2732-184-0x0000000000400000-0x00000000015C7000-memory.dmp
memory/2732-185-0x0000000001870000-0x0000000001876000-memory.dmp
memory/2732-183-0x0000000001860000-0x0000000001861000-memory.dmp
memory/2732-182-0x0000000001850000-0x0000000001851000-memory.dmp
memory/2732-181-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/2732-180-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/2732-179-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/2732-178-0x00000000001A0000-0x00000000001A1000-memory.dmp
memory/3004-128-0x0000000001820000-0x0000000001821000-memory.dmp
memory/3004-131-0x0000000001870000-0x0000000001871000-memory.dmp
memory/3004-127-0x0000000001810000-0x0000000001811000-memory.dmp
memory/3004-129-0x0000000001840000-0x0000000001841000-memory.dmp
memory/3004-130-0x0000000001850000-0x0000000001851000-memory.dmp
memory/3004-134-0x0000000001890000-0x0000000001896000-memory.dmp
memory/3004-133-0x0000000000400000-0x00000000015C7000-memory.dmp
memory/3004-132-0x0000000001880000-0x0000000001881000-memory.dmp
memory/3076-190-0x00000000018D0000-0x00000000018D1000-memory.dmp
memory/3076-193-0x0000000001920000-0x0000000001921000-memory.dmp
memory/3076-197-0x0000000001950000-0x0000000001962000-memory.dmp
memory/3076-196-0x0000000000400000-0x00000000015AF000-memory.dmp
memory/3076-195-0x0000000001940000-0x0000000001941000-memory.dmp
memory/3076-194-0x0000000001930000-0x0000000001931000-memory.dmp
memory/3076-191-0x00000000018E0000-0x00000000018E1000-memory.dmp
memory/3076-192-0x0000000001910000-0x0000000001911000-memory.dmp
memory/3600-173-0x000001D2B43D3000-0x000001D2B43D5000-memory.dmp
memory/3600-140-0x000001D2B3F60000-0x000001D2B3F61000-memory.dmp
memory/3600-171-0x000001D2B43D0000-0x000001D2B43D2000-memory.dmp
memory/3600-160-0x000001D2B43E0000-0x000001D2B43E1000-memory.dmp
memory/3600-172-0x000001D2CD430000-0x000001D2CD431000-memory.dmp
memory/3916-114-0x0000000000150000-0x0000000000151000-memory.dmp
memory/3916-121-0x00000000001D0000-0x00000000001D6000-memory.dmp
memory/3916-120-0x0000000000400000-0x00000000015C7000-memory.dmp
memory/3916-119-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/3916-118-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/3916-117-0x00000000001A0000-0x00000000001A1000-memory.dmp
memory/3916-116-0x0000000000190000-0x0000000000191000-memory.dmp
memory/3916-115-0x0000000000160000-0x0000000000161000-memory.dmp