Overview
overview
10Static
static
NewCovid-2...21.exe
windows7_x64
10NewCovid-2...21.exe
windows10-2004_x64
10NewCovid-2...ed.pdf
windows7_x64
1NewCovid-2...ed.pdf
windows10-2004_x64
1NewCovid-2...er.lnk
windows7_x64
10NewCovid-2...er.lnk
windows10-2004_x64
10NewCovid-2...ic.rtf
windows7_x64
8NewCovid-2...ic.rtf
windows10-2004_x64
1Analysis
-
max time kernel
84s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
28-02-2022 03:16
Static task
static1
Behavioral task
behavioral1
Sample
NewCovid-21/08042021.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NewCovid-21/08042021.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
NewCovid-21/GEO-CFUND-2009_CCM Agreement_Facesheet - signed.pdf
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
NewCovid-21/GEO-CFUND-2009_CCM Agreement_Facesheet - signed.pdf
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
NewCovid-21/New Folder.lnk
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
NewCovid-21/New Folder.lnk
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
NewCovid-21/Statistic.rtf
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
NewCovid-21/Statistic.rtf
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Malware Config
Signatures
-
OutSteel batch script 1 IoCs
Detects batch script dropped by OutSteel
resource yara_rule behavioral2/files/0x0003000000000725-134.dat outsteel_batch_script -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 988 created 2696 988 WerFault.exe 54 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: 08042021.exe File opened (read-only) \??\y: 08042021.exe File opened (read-only) \??\h: 08042021.exe File opened (read-only) \??\n: 08042021.exe File opened (read-only) \??\q: 08042021.exe File opened (read-only) \??\t: 08042021.exe File opened (read-only) \??\w: 08042021.exe File opened (read-only) \??\a: 08042021.exe File opened (read-only) \??\b: 08042021.exe File opened (read-only) \??\r: 08042021.exe File opened (read-only) \??\v: 08042021.exe File opened (read-only) \??\u: 08042021.exe File opened (read-only) \??\g: 08042021.exe File opened (read-only) \??\j: 08042021.exe File opened (read-only) \??\k: 08042021.exe File opened (read-only) \??\l: 08042021.exe File opened (read-only) \??\o: 08042021.exe File opened (read-only) \??\p: 08042021.exe File opened (read-only) \??\s: 08042021.exe File opened (read-only) \??\z: 08042021.exe File opened (read-only) \??\e: 08042021.exe File opened (read-only) \??\f: 08042021.exe File opened (read-only) \??\i: 08042021.exe File opened (read-only) \??\m: 08042021.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2696-132-0x0000000004990000-0x0000000004A6D000-memory.dmp autoit_exe behavioral2/memory/2696-133-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2616 2696 WerFault.exe 54 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 1 IoCs
pid Process 2452 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2616 WerFault.exe 2616 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2616 WerFault.exe Token: SeBackupPrivilege 2616 WerFault.exe Token: SeDebugPrivilege 2452 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 1636 2696 08042021.exe 65 PID 2696 wrote to memory of 1636 2696 08042021.exe 65 PID 2696 wrote to memory of 1636 2696 08042021.exe 65 PID 2696 wrote to memory of 2932 2696 08042021.exe 68 PID 2696 wrote to memory of 2932 2696 08042021.exe 68 PID 2696 wrote to memory of 2932 2696 08042021.exe 68 PID 2696 wrote to memory of 648 2696 08042021.exe 70 PID 2696 wrote to memory of 648 2696 08042021.exe 70 PID 2696 wrote to memory of 648 2696 08042021.exe 70 PID 2696 wrote to memory of 2184 2696 08042021.exe 73 PID 2696 wrote to memory of 2184 2696 08042021.exe 73 PID 2696 wrote to memory of 2184 2696 08042021.exe 73 PID 2696 wrote to memory of 788 2696 08042021.exe 75 PID 2696 wrote to memory of 788 2696 08042021.exe 75 PID 2696 wrote to memory of 788 2696 08042021.exe 75 PID 2696 wrote to memory of 1880 2696 08042021.exe 77 PID 2696 wrote to memory of 1880 2696 08042021.exe 77 PID 2696 wrote to memory of 1880 2696 08042021.exe 77 PID 2696 wrote to memory of 2264 2696 08042021.exe 81 PID 2696 wrote to memory of 2264 2696 08042021.exe 81 PID 2696 wrote to memory of 2264 2696 08042021.exe 81 PID 2696 wrote to memory of 1392 2696 08042021.exe 83 PID 2696 wrote to memory of 1392 2696 08042021.exe 83 PID 2696 wrote to memory of 1392 2696 08042021.exe 83 PID 2696 wrote to memory of 2140 2696 08042021.exe 85 PID 2696 wrote to memory of 2140 2696 08042021.exe 85 PID 2696 wrote to memory of 2140 2696 08042021.exe 85 PID 2696 wrote to memory of 3268 2696 08042021.exe 88 PID 2696 wrote to memory of 3268 2696 08042021.exe 88 PID 2696 wrote to memory of 3268 2696 08042021.exe 88 PID 2696 wrote to memory of 988 2696 08042021.exe 90 PID 2696 wrote to memory of 988 2696 08042021.exe 90 PID 2696 wrote to memory of 988 2696 08042021.exe 90 PID 2696 wrote to memory of 3276 2696 08042021.exe 93 PID 2696 wrote to memory of 3276 2696 08042021.exe 93 PID 2696 wrote to memory of 3276 2696 08042021.exe 93 PID 2696 wrote to memory of 1428 2696 08042021.exe 94 PID 2696 wrote to memory of 1428 2696 08042021.exe 94 PID 2696 wrote to memory of 1428 2696 08042021.exe 94 PID 2696 wrote to memory of 1816 2696 08042021.exe 97 PID 2696 wrote to memory of 1816 2696 08042021.exe 97 PID 2696 wrote to memory of 1816 2696 08042021.exe 97 PID 2696 wrote to memory of 1304 2696 08042021.exe 100 PID 2696 wrote to memory of 1304 2696 08042021.exe 100 PID 2696 wrote to memory of 1304 2696 08042021.exe 100 PID 2696 wrote to memory of 2152 2696 08042021.exe 103 PID 2696 wrote to memory of 2152 2696 08042021.exe 103 PID 2696 wrote to memory of 2152 2696 08042021.exe 103 PID 2696 wrote to memory of 1432 2696 08042021.exe 105 PID 2696 wrote to memory of 1432 2696 08042021.exe 105 PID 2696 wrote to memory of 1432 2696 08042021.exe 105 PID 2696 wrote to memory of 3112 2696 08042021.exe 108 PID 2696 wrote to memory of 3112 2696 08042021.exe 108 PID 2696 wrote to memory of 3112 2696 08042021.exe 108 PID 3112 wrote to memory of 3260 3112 cmd.exe 111 PID 3112 wrote to memory of 3260 3112 cmd.exe 111 PID 3112 wrote to memory of 3260 3112 cmd.exe 111 PID 988 wrote to memory of 2696 988 WerFault.exe 54 PID 988 wrote to memory of 2696 988 WerFault.exe 54 PID 3260 wrote to memory of 3376 3260 cmd.exe 115 PID 3260 wrote to memory of 3376 3260 cmd.exe 115 PID 3260 wrote to memory of 3376 3260 cmd.exe 115 PID 3260 wrote to memory of 2452 3260 cmd.exe 116 PID 3260 wrote to memory of 2452 3260 cmd.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewCovid-21\08042021.exe"C:\Users\Admin\AppData\Local\Temp\NewCovid-21\08042021.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A2⤵PID:1636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A2⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A2⤵PID:648
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:2184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A2⤵PID:788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A2⤵PID:1880
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A2⤵PID:2264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:1392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A2⤵PID:2140
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A2⤵PID:3268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A2⤵PID:988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A2⤵PID:3276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A2⤵PID:1428
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A2⤵PID:1816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A2⤵PID:1304
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A2⤵PID:2152
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A2⤵PID:1432
-
-
C:\Windows\SysWOW64\cmd.execmd /c start /min r.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K r.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.execmd /min /c del "C:\Users\Admin\AppData\Local\Temp\NewCovid-21\r.bat"4⤵PID:3376
-
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /IM cmd.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 7202⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2696 -ip 26961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:988