Analysis
- max time kernel
144s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
19/02/2022, 13:02
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.MalPack.GS.21189.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Trojan.MalPack.GS.21189.exe
- Size 315KB
- Sample220219-p9twasbdhm
- SHA256 f106e2e0fa9b292f28808409cdc7a363f3c9310fbb547d896fdadcde4e8ea660
- MD5 4d5b4f886995716e343d14b9fbaf6299
- SHA1 fa2de8445dd7275c31568756c731fab58adf14e0
- SHA512 b3d7a10ba738b2daa2833d0d192b3af0d7b5614964d0bae03256a609860fb11330cadc5f02b0dca834c1f68883230a6abcfcbb650d74ab35397eec6d425af128
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
arkei
Botnet
-
Default
C2
-
http://woor.link/548152.php
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2520 created 1344 2520 WerFault.exe 56 - suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Trojan.MalPack.GS.21189.exe - Loads dropped DLL 3 IoCs
pid Process 1344 SecuriteInfo.com.Trojan.MalPack.GS.21189.exe 1344 SecuriteInfo.com.Trojan.MalPack.GS.21189.exe 1344 SecuriteInfo.com.Trojan.MalPack.GS.21189.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3980 1344 WerFault.exe 56 - Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SecuriteInfo.com.Trojan.MalPack.GS.21189.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SecuriteInfo.com.Trojan.MalPack.GS.21189.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2776 timeout.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe - Modifies data under HKEY_USERS 52 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.250042" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4092" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4368" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.332800" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "14.380634" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4344" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.006559" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4012" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899257447980842" svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3980 WerFault.exe 3980 WerFault.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe Token: SeRestorePrivilege 2332 TiWorker.exe Token: SeSecurityPrivilege 2332 TiWorker.exe Token: SeBackupPrivilege 2332 TiWorker.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1344 wrote to memory of 664 1344 SecuriteInfo.com.Trojan.MalPack.GS.21189.exe 69 PID 1344 wrote to memory of 664 1344 SecuriteInfo.com.Trojan.MalPack.GS.21189.exe 69 PID 1344 wrote to memory of 664 1344 SecuriteInfo.com.Trojan.MalPack.GS.21189.exe 69 PID 664 wrote to memory of 2776 664 cmd.exe 72 PID 664 wrote to memory of 2776 664 cmd.exe 72 PID 664 wrote to memory of 2776 664 cmd.exe 72 PID 2520 wrote to memory of 1344 2520 WerFault.exe 56 PID 2520 wrote to memory of 1344 2520 WerFault.exe 56
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MalPack.GS.21189.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MalPack.GS.21189.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MalPack.GS.21189.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:2776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 15682⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3980
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2276
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3828
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1344 -ip 13441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2520