Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-12-2021 19:59
Static task
static1
Behavioral task
behavioral1
Sample
3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe
-
Size
161KB
-
MD5
8c5d3c16ae8cb907379a21bfab8cbb56
-
SHA1
c953abf45094625232a4b7a46ad91948e3f97b9e
-
SHA256
3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a
-
SHA512
25fc4b10d8e44b80a2bd47d3413ce99f647d1ad083fdc3c56e5c47e9d24deed0bcd1b998cbdf7ae672edc087d4d1c6b5773150471b189ee635336257ddc2b878
Score
10/10
Malware Config
Signatures
-
VKeylogger
A keylogger first seen in Nov 2020.
-
VKeylogger Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3064-116-0x0000000000400000-0x000000000081A000-memory.dmp family_vkeylogger behavioral1/memory/2588-119-0x00000000003B0000-0x00000000003BF000-memory.dmp family_vkeylogger -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeDriver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Firefox_update = "C:\\Windows\\system32\\mshta.exe javascript:x=new%20ActiveXObject(\"wscript.shell\");v=x.RegRead(\"HKCU\\\\Software\\\\Microsoft\\\\SMSvcHost\\\\ComponentID\");eval(v);" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exedescription pid process target process PID 3064 set thread context of 2588 3064 3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exeexplorer.exepid process 3064 3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe 2588 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
explorer.exepid process 2588 explorer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exedescription pid process target process PID 3064 wrote to memory of 2588 3064 3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe explorer.exe PID 3064 wrote to memory of 2588 3064 3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe explorer.exe PID 3064 wrote to memory of 2588 3064 3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe"C:\Users\Admin\AppData\Local\Temp\3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2588-118-0x00000000003B2E90-mapping.dmp
-
memory/2588-119-0x00000000003B0000-0x00000000003BF000-memory.dmpFilesize
60KB
-
memory/3064-116-0x0000000000400000-0x000000000081A000-memory.dmpFilesize
4.1MB
-
memory/3064-115-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/3064-117-0x0000000000820000-0x000000000096A000-memory.dmpFilesize
1.3MB