Analysis
-
max time kernel
105s -
max time network
59s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
01-10-2021 10:23
Static task
static1
Behavioral task
behavioral1
Sample
gwq6YRD8.exe
Resource
win7v20210408
General
-
Target
gwq6YRD8.exe
-
Size
993KB
-
MD5
d3a501cec812ab3556e256429e2387a5
-
SHA1
273924b22cc3ae8172ec4e13d6a4d01d9ea5dd9f
-
SHA256
93082becf838b94356514a5f5ae205ae6928540a9cef12722fe52cabb9a0a33d
-
SHA512
18598996a2d0d176256b490737eca73be461f39a08e555d010658177329912e7ff43e0dfe43c36196386fa3c159a549e29df148f7f250b59e4197ab6cffbd139
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 4 IoCs
Processes:
gwq6YRD8.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini gwq6YRD8.exe File opened for modification C:\Program Files\desktop.ini gwq6YRD8.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini gwq6YRD8.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini gwq6YRD8.exe -
Drops file in Program Files directory 10 IoCs
Processes:
gwq6YRD8.exedescription ioc process File opened for modification C:\Program Files\CompressUndo.fon gwq6YRD8.exe File opened for modification C:\Program Files\DebugExit.emz gwq6YRD8.exe File opened for modification C:\Program Files\FormatClose.vb gwq6YRD8.exe File opened for modification C:\Program Files\InstallUninstall.xlsm gwq6YRD8.exe File opened for modification C:\Program Files\MeasureDisconnect.raw gwq6YRD8.exe File opened for modification C:\Program Files\CloseExit.lnk gwq6YRD8.exe File opened for modification C:\Program Files\RequestComplete.emf gwq6YRD8.exe File opened for modification C:\Program Files\ResetUnregister.cmd gwq6YRD8.exe File opened for modification C:\Program Files\SelectApprove.midi gwq6YRD8.exe File opened for modification C:\Program Files\desktop.ini gwq6YRD8.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
gwq6YRD8.execmd.exedescription pid process target process PID 332 wrote to memory of 772 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 772 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 772 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 772 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 680 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 680 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 680 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 680 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 1496 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 1496 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 1496 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 1496 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 1488 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 1488 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 1488 332 gwq6YRD8.exe cmd.exe PID 332 wrote to memory of 1488 332 gwq6YRD8.exe cmd.exe PID 1488 wrote to memory of 1484 1488 cmd.exe notepad.exe PID 1488 wrote to memory of 1484 1488 cmd.exe notepad.exe PID 1488 wrote to memory of 1484 1488 cmd.exe notepad.exe PID 1488 wrote to memory of 1484 1488 cmd.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gwq6YRD8.exe"C:\Users\Admin\AppData\Local\Temp\gwq6YRD8.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vol C:2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vol C:2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vol C:2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c notepad "D9F57D92.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad "D9F57D92.txt"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\D9F57D92.txtMD5
d78bf3c7aeeee5b685af520db98fba33
SHA100e42a49974db74f23ed6a5fe6e36296b72298d8
SHA256c3f62143c6dc62dd3a6a55edddbc8b5a4ac49298aed007e2ac797100a02eaab3
SHA51292dbbc6593cf42759a0ebdd6284f86695ee8eee1559decafc2e5f11c297a29614c1aa26a0cf46cd3184a421742a1c4457e43176b8402c28e0336fb668302c044
-
memory/332-60-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/680-62-0x0000000000000000-mapping.dmp
-
memory/772-61-0x0000000000000000-mapping.dmp
-
memory/1484-65-0x0000000000000000-mapping.dmp
-
memory/1488-64-0x0000000000000000-mapping.dmp
-
memory/1496-63-0x0000000000000000-mapping.dmp