Analysis
- max time kernel
183s - max time network
192s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe
- Size 397KB
- Sample220128-srb5bafhc4
- SHA256 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30
- MD5 70d8729ca630dd3b0f9a62998642ec76
- SHA1 68c60a1aa333fc48ec7b8c95b35d0bb53a1b5918
- SHA512 0fc480fa05e2fded0e421f2c89a3d17f580ab877c00b76f4e3e4a3b0ee5f132701fe4dbdca81baf60d3021733663c24470143d8d65d45e82789e83f772c22e74
- MD5 SHA1 SHA512
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\6815cdb9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{BFD3F919-F954-4DCD-997C-E6033CA81808}\\6815cdb9.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6815cdb9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{BFD3F919-F954-4DCD-997C-E6033CA81808}\\6815cdb9.exe" svchost.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2564 set thread context of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 388 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 388 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeDebugPrivilege 1044 svchost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2564 wrote to memory of 1228 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 69 PID 2564 wrote to memory of 1228 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 69 PID 2564 wrote to memory of 1228 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 69 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 2564 wrote to memory of 388 2564 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 71 PID 388 wrote to memory of 1044 388 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 74 PID 388 wrote to memory of 1044 388 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 74 PID 388 wrote to memory of 1044 388 536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe"C:\Users\Admin\AppData\Local\Temp\536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:1228
-
-
C:\Users\Admin\AppData\Local\Temp\536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe"C:\Users\Admin\AppData\Local\Temp\536fc552cc24733f05f5a3be333c030fc848060da978b282d67d67a7c76c0d30.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-