Analysis
-
max time kernel
48s -
max time network
49s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
08-10-2021 14:29
Static task
static1
General
-
Target
TrayHelper.exe
-
Size
6.6MB
-
MD5
ed629675ffcbd864df0c8a39467e7a1d
-
SHA1
f70a3a6c1175ad86c40e5b062f7145df4595f467
-
SHA256
9112098aacf18ad20a8ef5a79f48e5da4b67d63c5caa84878193e01f075160fe
-
SHA512
c11252b55faa35ecec0e68771cf298e5e7a578da3406d0c2bb86661faa9bbc887090bbf658a917b6768963c1cffaccb869e97de70daca408666d9b8ffd266837
Malware Config
Signatures
-
Loads dropped DLL 14 IoCs
Processes:
TrayHelper.exepid process 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe 2500 TrayHelper.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ipinfo.io -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
TrayHelper.exedescription pid process Token: SeDebugPrivilege 2500 TrayHelper.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
TrayHelper.exedescription pid process target process PID 1676 wrote to memory of 2500 1676 TrayHelper.exe TrayHelper.exe PID 1676 wrote to memory of 2500 1676 TrayHelper.exe TrayHelper.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrayHelper.exe"C:\Users\Admin\AppData\Local\Temp\TrayHelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TrayHelper.exe"C:\Users\Admin\AppData\Local\Temp\TrayHelper.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\VCRUNTIME140.dllMD5
8697c106593e93c11adc34faa483c4a0
SHA1cd080c51a97aa288ce6394d6c029c06ccb783790
SHA256ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
SHA512724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\_bz2.pydMD5
b89b6c064cd8241ae12addb7f376cab2
SHA129e86a1df404c442e14344042d39a98dd15425f7
SHA2560563df6e938b836f817c49e0cf9828cc251b2092a84273152ea5a7c537c03beb
SHA512f87b1c6d90cfb01316a17ad37f27287d5ef4ff3a0f7fd25303203ea7c7fa1ed12c1aef486dc9bbb8b4d527f37e771b950fa5142b2bac01f52afbfdbf7a77111d
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\_ctypes.pydMD5
4d13a7b3ecc8c7dc96a0424c465d7251
SHA10c72f7259ac9108d956aede40b6fcdf3a3943cb5
SHA2562995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed
SHA51268ff7c421007d63a970269089afb39c949d6cf9f4d56aff7e4e0b88d3c43cfaa352364c5326523386c00727cc36e64274a51b5dbb3a343b16201cf5fc264fec8
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\_hashlib.pydMD5
496cde3c381c8e33186354631dfad0f1
SHA1cbdb280ecb54469fd1987b9eff666d519e20249f
SHA256f9548e3b71764ac99efb988e4daac249e300eb629c58d2a341b753299180c679
SHA512f7245eb24f2b6d8bc22f876d6abb90e77db46bf0e5ab367f2e02e4ca936c898a5a14d843235adc5502f6d74715da0b93d86222e8dec592ae41ab59d56432bf4f
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\_lzma.pydMD5
6e396653552d446c8114e98e5e195d09
SHA1c1f760617f7f640d6f84074d6d5218d5a338a6ec
SHA2565ddba137db772b61d4765c45b6156b2ee33a1771ddd52dd55b0ef592535785cf
SHA512c4bf2c4c51350b9142da3faeadf72f94994e614f9e43e3c2a1675aa128c6e7f1212fd388a71124971648488bb718ca9b66452e5d0d0b840a0979df7146ed7ae5
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\_socket.pydMD5
eb974aeda30d7478bb800bb4c5fbc0a2
SHA1c5b7bc326bd003d42bcf620d657cac3f46f9d566
SHA2561db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016
SHA512f9eea3636371ba508d563cf21541a21879ce50a5666e419ecfd74255c8decc3ae5e2ceb4a8f066ae519101dd71a116335a359e3343e8b2ff3884812099ae9b1b
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\_ssl.pydMD5
fefbb91866778278460e16e44cfb8151
SHA153890f03a999078b70b921b104df198f2f481a7c
SHA2568a10b301294a35bc3a96a59ca434a628753a13d26de7c7cb51d37cf96c3bdbb5
SHA512449b5f0c089626db1824ebe405b97a67b073ea7ce22cee72aa3b2490136b3b6218e9f15d71da6fd32fba090255d3a0ba0e77a36c1f8b8bea45f6be95a91e388d
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\base_library.zipMD5
df8b8c969ff2b6f8bb7366501364edea
SHA1abe794715ba88790786c171625db7547f6f7dbac
SHA2566cb8ff9586c8511e415b08fb2ea329c66eb4e19c345a951b29781f8bf6de3b08
SHA51280415fce07ddc2bd4ccad95b9d4899ee7745a5f001880e72f8eee80eca884ed432a9dcbf1301cf193e09f89d74393469cdd7e2d5eca89b77e40b98323cbf5a3b
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\libcrypto-1_1.dllMD5
cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\libffi-7.dllMD5
eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\libssl-1_1.dllMD5
bc778f33480148efa5d62b2ec85aaa7d
SHA1b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA2569d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA51280c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\psutil\_psutil_windows.cp38-win_amd64.pydMD5
81467ae2ccfd303b3ae249b271d02393
SHA1025316c0ffd42bb6085731596b5e5cf36a2ee400
SHA256b8dfb9df359c67334c017a8bdcad257e4ed5ef1637761acf40d19c4df040f8e1
SHA5123d4f02a97298d894e351514c9d719730b7de4baace38fcf395275bdde399158d35d10533a5ae762c24b748594e64109112a8d88f1b76b15beb2af47bc7db272e
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\python38.dllMD5
3cd1e87aeb3d0037d52c8e51030e1084
SHA149ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af
SHA25613f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8
SHA512497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\select.pydMD5
08b499ae297c5579ba05ea87c31aff5b
SHA14a1a9f1bf41c284e9c5a822f7d018f8edc461422
SHA256940fb90fd78b5be4d72279dcf9c24a8b1fcf73999f39909980b12565a7921281
SHA512ab26f4f80449aa9cc24e68344fc89aeb25d5ba5aae15aeed59a804216825818edfe31c7fda837a93a6db4068ccfb1cc7e99173a80bd9dda33bfb2d3b5937d7e9
-
C:\Users\Admin\AppData\Local\Temp\_MEI16762\unicodedata.pydMD5
84fb421643cab316ce623aa84395a950
SHA14fba083864b3811b8a09644d559186ecb347c387
SHA2565578c3054f8846be86e686fb73b62b1f931d3ed1a7859b87925a96774371dba4
SHA512a2132f93b0e4292dc9c32da2a6478769ec4f58be5c36ee2701e2a66154ea1dc2c0684fc7698e7c3ac04f5c1d366cb9633a9366e5a38b7ff7a964ff25ea266f9f
-
\Users\Admin\AppData\Local\Temp\_MEI16762\VCRUNTIME140.dllMD5
8697c106593e93c11adc34faa483c4a0
SHA1cd080c51a97aa288ce6394d6c029c06ccb783790
SHA256ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
SHA512724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
-
\Users\Admin\AppData\Local\Temp\_MEI16762\_bz2.pydMD5
b89b6c064cd8241ae12addb7f376cab2
SHA129e86a1df404c442e14344042d39a98dd15425f7
SHA2560563df6e938b836f817c49e0cf9828cc251b2092a84273152ea5a7c537c03beb
SHA512f87b1c6d90cfb01316a17ad37f27287d5ef4ff3a0f7fd25303203ea7c7fa1ed12c1aef486dc9bbb8b4d527f37e771b950fa5142b2bac01f52afbfdbf7a77111d
-
\Users\Admin\AppData\Local\Temp\_MEI16762\_ctypes.pydMD5
4d13a7b3ecc8c7dc96a0424c465d7251
SHA10c72f7259ac9108d956aede40b6fcdf3a3943cb5
SHA2562995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed
SHA51268ff7c421007d63a970269089afb39c949d6cf9f4d56aff7e4e0b88d3c43cfaa352364c5326523386c00727cc36e64274a51b5dbb3a343b16201cf5fc264fec8
-
\Users\Admin\AppData\Local\Temp\_MEI16762\_hashlib.pydMD5
496cde3c381c8e33186354631dfad0f1
SHA1cbdb280ecb54469fd1987b9eff666d519e20249f
SHA256f9548e3b71764ac99efb988e4daac249e300eb629c58d2a341b753299180c679
SHA512f7245eb24f2b6d8bc22f876d6abb90e77db46bf0e5ab367f2e02e4ca936c898a5a14d843235adc5502f6d74715da0b93d86222e8dec592ae41ab59d56432bf4f
-
\Users\Admin\AppData\Local\Temp\_MEI16762\_lzma.pydMD5
6e396653552d446c8114e98e5e195d09
SHA1c1f760617f7f640d6f84074d6d5218d5a338a6ec
SHA2565ddba137db772b61d4765c45b6156b2ee33a1771ddd52dd55b0ef592535785cf
SHA512c4bf2c4c51350b9142da3faeadf72f94994e614f9e43e3c2a1675aa128c6e7f1212fd388a71124971648488bb718ca9b66452e5d0d0b840a0979df7146ed7ae5
-
\Users\Admin\AppData\Local\Temp\_MEI16762\_socket.pydMD5
eb974aeda30d7478bb800bb4c5fbc0a2
SHA1c5b7bc326bd003d42bcf620d657cac3f46f9d566
SHA2561db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016
SHA512f9eea3636371ba508d563cf21541a21879ce50a5666e419ecfd74255c8decc3ae5e2ceb4a8f066ae519101dd71a116335a359e3343e8b2ff3884812099ae9b1b
-
\Users\Admin\AppData\Local\Temp\_MEI16762\_ssl.pydMD5
fefbb91866778278460e16e44cfb8151
SHA153890f03a999078b70b921b104df198f2f481a7c
SHA2568a10b301294a35bc3a96a59ca434a628753a13d26de7c7cb51d37cf96c3bdbb5
SHA512449b5f0c089626db1824ebe405b97a67b073ea7ce22cee72aa3b2490136b3b6218e9f15d71da6fd32fba090255d3a0ba0e77a36c1f8b8bea45f6be95a91e388d
-
\Users\Admin\AppData\Local\Temp\_MEI16762\libcrypto-1_1.dllMD5
cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
\Users\Admin\AppData\Local\Temp\_MEI16762\libffi-7.dllMD5
eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
\Users\Admin\AppData\Local\Temp\_MEI16762\libssl-1_1.dllMD5
bc778f33480148efa5d62b2ec85aaa7d
SHA1b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA2569d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA51280c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173
-
\Users\Admin\AppData\Local\Temp\_MEI16762\psutil\_psutil_windows.cp38-win_amd64.pydMD5
81467ae2ccfd303b3ae249b271d02393
SHA1025316c0ffd42bb6085731596b5e5cf36a2ee400
SHA256b8dfb9df359c67334c017a8bdcad257e4ed5ef1637761acf40d19c4df040f8e1
SHA5123d4f02a97298d894e351514c9d719730b7de4baace38fcf395275bdde399158d35d10533a5ae762c24b748594e64109112a8d88f1b76b15beb2af47bc7db272e
-
\Users\Admin\AppData\Local\Temp\_MEI16762\python38.dllMD5
3cd1e87aeb3d0037d52c8e51030e1084
SHA149ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af
SHA25613f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8
SHA512497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340
-
\Users\Admin\AppData\Local\Temp\_MEI16762\select.pydMD5
08b499ae297c5579ba05ea87c31aff5b
SHA14a1a9f1bf41c284e9c5a822f7d018f8edc461422
SHA256940fb90fd78b5be4d72279dcf9c24a8b1fcf73999f39909980b12565a7921281
SHA512ab26f4f80449aa9cc24e68344fc89aeb25d5ba5aae15aeed59a804216825818edfe31c7fda837a93a6db4068ccfb1cc7e99173a80bd9dda33bfb2d3b5937d7e9
-
\Users\Admin\AppData\Local\Temp\_MEI16762\unicodedata.pydMD5
84fb421643cab316ce623aa84395a950
SHA14fba083864b3811b8a09644d559186ecb347c387
SHA2565578c3054f8846be86e686fb73b62b1f931d3ed1a7859b87925a96774371dba4
SHA512a2132f93b0e4292dc9c32da2a6478769ec4f58be5c36ee2701e2a66154ea1dc2c0684fc7698e7c3ac04f5c1d366cb9633a9366e5a38b7ff7a964ff25ea266f9f
-
memory/2500-115-0x0000000000000000-mapping.dmp