Analysis
- max time kernel
134s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
28/02/2022, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
- Size 634KB
- Sample220228-dv2f2sdac6
- SHA256 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43
- MD5 d4fa9c88bd43d2b9bcb66c3e7292b52a
- SHA1 5cf627b7cc836506958a5e04e902f8530cdb58b6
- SHA512 2088445e2dd2e9497c97acb7ad426536c2d190014702fd4c77193193db42cedbb9dcae918e37ce4161393a4043f36e76ff2947e0276fe4647b38478725d03919
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\f: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\g: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\i: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\k: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\l: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\n: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\a: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\w: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\x: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\y: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\z: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\s: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\p: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\u: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\o: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\h: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\j: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\m: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\t: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\v: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\e: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\r: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe File opened (read-only) \??\q: b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4292-135-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4292-136-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2368 set thread context of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 2368 wrote to memory of 4292 2368 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 86 PID 4292 wrote to memory of 3384 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 87 PID 4292 wrote to memory of 3384 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 87 PID 4292 wrote to memory of 3384 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 87 PID 4292 wrote to memory of 3424 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 89 PID 4292 wrote to memory of 3424 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 89 PID 4292 wrote to memory of 3424 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 89 PID 4292 wrote to memory of 5068 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 91 PID 4292 wrote to memory of 5068 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 91 PID 4292 wrote to memory of 5068 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 91 PID 4292 wrote to memory of 4308 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 93 PID 4292 wrote to memory of 4308 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 93 PID 4292 wrote to memory of 4308 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 93 PID 4292 wrote to memory of 1504 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 95 PID 4292 wrote to memory of 1504 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 95 PID 4292 wrote to memory of 1504 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 95 PID 4292 wrote to memory of 1976 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 97 PID 4292 wrote to memory of 1976 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 97 PID 4292 wrote to memory of 1976 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 97 PID 4292 wrote to memory of 3428 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 99 PID 4292 wrote to memory of 3428 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 99 PID 4292 wrote to memory of 3428 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 99 PID 4292 wrote to memory of 3064 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 101 PID 4292 wrote to memory of 3064 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 101 PID 4292 wrote to memory of 3064 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 101 PID 4292 wrote to memory of 3628 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 103 PID 4292 wrote to memory of 3628 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 103 PID 4292 wrote to memory of 3628 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 103 PID 4292 wrote to memory of 256 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 105 PID 4292 wrote to memory of 256 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 105 PID 4292 wrote to memory of 256 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 105 PID 4292 wrote to memory of 2544 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 107 PID 4292 wrote to memory of 2544 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 107 PID 4292 wrote to memory of 2544 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 107 PID 4292 wrote to memory of 3796 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 109 PID 4292 wrote to memory of 3796 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 109 PID 4292 wrote to memory of 3796 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 109 PID 4292 wrote to memory of 3760 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 111 PID 4292 wrote to memory of 3760 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 111 PID 4292 wrote to memory of 3760 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 111 PID 4292 wrote to memory of 3116 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 113 PID 4292 wrote to memory of 3116 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 113 PID 4292 wrote to memory of 3116 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 113 PID 4292 wrote to memory of 3448 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 115 PID 4292 wrote to memory of 3448 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 115 PID 4292 wrote to memory of 3448 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 115 PID 4292 wrote to memory of 628 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 117 PID 4292 wrote to memory of 628 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 117 PID 4292 wrote to memory of 628 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 117 PID 4292 wrote to memory of 1184 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 119 PID 4292 wrote to memory of 1184 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 119 PID 4292 wrote to memory of 1184 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 119 PID 4292 wrote to memory of 1352 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 121 PID 4292 wrote to memory of 1352 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 121 PID 4292 wrote to memory of 1352 4292 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe"C:\Users\Admin\AppData\Local\Temp\b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exeC:\Users\Admin\AppData\Local\Temp\b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A3⤵PID:3384
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A3⤵PID:3424
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A3⤵PID:5068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:4308
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A3⤵PID:1504
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A3⤵PID:1976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A3⤵PID:3428
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:3064
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A3⤵PID:3628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A3⤵PID:256
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A3⤵PID:2544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A3⤵PID:3796
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A3⤵PID:3760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A3⤵PID:3116
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A3⤵PID:3448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A3⤵PID:628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A3⤵PID:1184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A3⤵PID:1352
-
-