Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
28-02-2022 03:20
Static task
static1
Behavioral task
behavioral1
Sample
3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe
Resource
win7-20220223-en
General
-
Target
3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe
-
Size
614KB
-
MD5
124f0b9dadbef030a4cba26393ce25df
-
SHA1
15479f31109fd0a367ad681fb3ee63c6fb0ade0a
-
SHA256
3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db
-
SHA512
7ef9d49f28d1728a6ef58a9a2d39848dee0f08184b202aeb65460869fed35e6f99466d9bce8cb6582fd4089bc63af95216c1252af1f2a3dd2c24e43546352a74
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exedescription ioc process File opened (read-only) \??\u: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\v: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\x: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\y: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\z: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\g: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\m: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\r: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\q: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\t: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\e: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\k: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\o: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\l: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\w: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\b: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\h: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\j: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\n: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\p: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\s: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\a: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\f: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe File opened (read-only) \??\i: 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1312-135-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/1312-136-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exedescription pid process target process PID 1652 set thread context of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exedescription pid process Token: SeDebugPrivilege 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exedescription pid process target process PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1652 wrote to memory of 1312 1652 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe PID 1312 wrote to memory of 4640 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4640 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4640 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4644 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4644 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4644 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2224 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2224 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2224 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4244 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4244 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4244 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 368 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 368 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 368 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1272 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1272 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1272 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2428 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2428 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2428 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1752 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1752 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1752 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2876 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2876 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2876 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4340 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4340 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4340 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 3484 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 3484 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 3484 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4452 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4452 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 4452 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2068 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2068 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 2068 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1872 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1872 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1872 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 3692 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 3692 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 3692 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 636 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 636 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 636 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 888 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 888 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 888 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1240 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1240 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe PID 1312 wrote to memory of 1240 1312 3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe"C:\Users\Admin\AppData\Local\Temp\3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exeC:\Users\Admin\AppData\Local\Temp\3d7a05e7ba9b3dd84017acab9aab59b459db6c50e9224ec1827cbf0a2aee47db.exe2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1312-135-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/1312-136-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/1652-130-0x00000000005F0000-0x000000000068C000-memory.dmpFilesize
624KB
-
memory/1652-131-0x000000007476E000-0x000000007476F000-memory.dmpFilesize
4KB
-
memory/1652-132-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/1652-133-0x0000000005050000-0x00000000050C6000-memory.dmpFilesize
472KB
-
memory/1652-134-0x0000000005020000-0x000000000503E000-memory.dmpFilesize
120KB