Analysis
- max time kernel
150s - max time network
127s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
30/09/2021, 13:19
Static task
static1
Behavioral task
behavioral1
Sample
703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe
- Size 409KB
- Sample210930-qky96aaaak
- SHA256 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d
- MD5 d891bae31afba4a67b81e54907dfc682
- SHA1 ddd1b5f964d50fe72e20211c9fd4e227d2569aca
- SHA512 755b1eeb09caf593446b0a3da1e9ba9f4850c1866b07ff99b23e02226d6d415e52b0329f91624adc52e3f7e2f6cca3c66de2a5d4c3f4f010ab64cece7fb322a0
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 8 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\6e1fd7257119071fe0e08a91b9dfef10\Admin@RSSLLXYN_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\6e1fd7257119071fe0e08a91b9dfef10\Admin@RSSLLXYN_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\6e1fd7257119071fe0e08a91b9dfef10\Admin@RSSLLXYN_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\6e1fd7257119071fe0e08a91b9dfef10\Admin@RSSLLXYN_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\6e1fd7257119071fe0e08a91b9dfef10\Admin@RSSLLXYN_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File opened for modification C:\Users\Admin\AppData\Local\6e1fd7257119071fe0e08a91b9dfef10\Admin@RSSLLXYN_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File opened for modification C:\Users\Admin\AppData\Local\6e1fd7257119071fe0e08a91b9dfef10\Admin@RSSLLXYN_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\6e1fd7257119071fe0e08a91b9dfef10\Admin@RSSLLXYN_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 icanhazip.com - Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4428 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe Token: SeDebugPrivilege 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3696 wrote to memory of 4492 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 71 PID 3696 wrote to memory of 4492 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 71 PID 3696 wrote to memory of 4492 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 71 PID 4492 wrote to memory of 3164 4492 cmd.exe 73 PID 4492 wrote to memory of 3164 4492 cmd.exe 73 PID 4492 wrote to memory of 3164 4492 cmd.exe 73 PID 4492 wrote to memory of 3208 4492 cmd.exe 74 PID 4492 wrote to memory of 3208 4492 cmd.exe 74 PID 4492 wrote to memory of 3208 4492 cmd.exe 74 PID 4492 wrote to memory of 3784 4492 cmd.exe 75 PID 4492 wrote to memory of 3784 4492 cmd.exe 75 PID 4492 wrote to memory of 3784 4492 cmd.exe 75 PID 3696 wrote to memory of 1908 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 76 PID 3696 wrote to memory of 1908 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 76 PID 3696 wrote to memory of 1908 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 76 PID 1908 wrote to memory of 3256 1908 cmd.exe 78 PID 1908 wrote to memory of 3256 1908 cmd.exe 78 PID 1908 wrote to memory of 3256 1908 cmd.exe 78 PID 1908 wrote to memory of 432 1908 cmd.exe 79 PID 1908 wrote to memory of 432 1908 cmd.exe 79 PID 1908 wrote to memory of 432 1908 cmd.exe 79 PID 3696 wrote to memory of 4428 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 80 PID 3696 wrote to memory of 4428 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 80 PID 3696 wrote to memory of 4428 3696 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe"C:\Users\Admin\AppData\Local\Temp\703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe"1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:3164
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:3208
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:3784
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:3256
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:432
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Local\Temp\703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe"2⤵
- Creates scheduled task(s)
PID:4428
-