Analysis
-
max time kernel
154s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-04-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe
Resource
win10v2004-20220414-en
General
-
Target
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe
-
Size
207KB
-
MD5
0a6533f28d8fd2c0787b0efd3639f5ed
-
SHA1
4ce9dd199563540da0ed450927e66b46f414e414
-
SHA256
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42
-
SHA512
c38080f0ee9a398252e567e9d9ae87692e0a31e51bd3400972c6b86b68983e15fc0556db97d5c27226ee8b08e0be52c68d600e30fc31cc01a59c32340cd13722
Malware Config
Signatures
-
suricata: ET MALWARE TSPY_BANKER.IDV/Infostealer.Bancos Module Download
suricata: ET MALWARE TSPY_BANKER.IDV/Infostealer.Bancos Module Download
-
Loads dropped DLL 1 IoCs
Processes:
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exepid process 1544 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cftmon = "C:\\Windows\\system32\\cftmon.exe" 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe -
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Modifies WinLogon 2 TTPs 11 IoCs
Processes:
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Startup = "fnGbf2" 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logon = "fnGbf2" 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Shutdown = "fnGbf2" 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Asynchronous = "0" 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Impersonate = "0" 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\DllName = "C:\\Windows\\system32\\mshyta16.dll" 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\StartShell = "fnGbf2" 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logoff = "fnGbf2" 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe -
Drops file in System32 directory 5 IoCs
Processes:
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exedescription ioc process File created C:\Windows\SysWOW64\cftmon.exe 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe File created C:\Windows\SysWOW64\mshyta16.dll 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe File opened for modification C:\Windows\SysWOW64\mshyta16.dll 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe File created C:\Windows\SysWOW64\mshdtxt32.dat 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe File opened for modification C:\Windows\SysWOW64\mshdtxt32.dat 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exepid process 1544 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe 1544 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exepid process 1544 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe 1544 4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe"C:\Users\Admin\AppData\Local\Temp\4972624436d63615a384952d200b3a55258a590ccf0c613d9e37e5418e120e42.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\gbf259B.tmpFilesize
25KB
MD5d471b32dcd464e9e7fc14f940d14c4ad
SHA1e57c539a91521e372fc427b271afe9567641e5d5
SHA2563c25589f7e5ca3f5201049a45132180fa2ab9b02865705798675f4b7fb803dc1
SHA5127cb29a6ddaeb11ca696fd13a3cab2b90aecaedb28c3693fb292731610665e77431c2c88f7f3fb0ae976a28a5eda0460e2d8ef6db65efdf368c1e1ebd1129a1c9
-
memory/1544-55-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB