Analysis
- max time kernel
30s - max time network
114s - platform
windows10_x64 - resource
win10v20210408 - submitted
03/09/2021, 04:26
General
- Target F1AA28FCF0CD2CB6CD5DBC4908CA8590.exe
- Size 1.4MB
- Sample210903-e2jegscae8
- SHA256 1b80ff02d64c454a3965d1c7ba536c5eca9e3c289301da557496f938c2a24a95
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Loads dropped DLL 5 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\F1AA28FCF0CD2CB6CD5DBC4908CA8590.exe"C:\Users\Admin\AppData\Local\Temp\F1AA28FCF0CD2CB6CD5DBC4908CA8590.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\F1AA28FCF0CD2CB6CD5DBC4908CA8590.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
-