Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 22:48
Static task
static1
Behavioral task
behavioral1
Sample
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe
Resource
win10v2004-20220721-en
General
-
Target
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe
-
Size
1.5MB
-
MD5
78ad3bdb9ba3be7e4f88e9a777e9c0db
-
SHA1
f00c8ccbd2b8394c9aac9b6fad557375f9d77fa2
-
SHA256
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904
-
SHA512
f628dad81b2a6fea32daa8fd659c6c3bd4081ddd1aab693b2b757e408c731f2e19aa286c7baeafcdc3fd333bc01ef73042fcae8908d4a797963a9c617a875519
Malware Config
Signatures
-
suricata: ET MALWARE Win32/Kelihos.F Checkin
suricata: ET MALWARE Win32/Kelihos.F Checkin
-
Processes:
resource yara_rule behavioral1/memory/1360-76-0x0000000000400000-0x000000000063F000-memory.dmp upx behavioral1/memory/1360-77-0x0000000000400000-0x000000000063F000-memory.dmp upx behavioral1/memory/1360-78-0x0000000000400000-0x000000000063F000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe" 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exepid process 1360 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exedescription pid process target process PID 1604 set thread context of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exepid process 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exepid process 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exedescription pid process target process PID 1604 wrote to memory of 996 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 996 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 996 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 996 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1516 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1516 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1516 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1516 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe PID 1604 wrote to memory of 1360 1604 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe 5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe"C:\Users\Admin\AppData\Local\Temp\5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exeC:\Users\Admin\AppData\Local\Temp\5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exeC:\Users\Admin\AppData\Local\Temp\5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exeC:\Users\Admin\AppData\Local\Temp\5766b6d1c27a6e3b8f08f75b41f190ac48e7f4ed2d855a88e02dff25f88e8904.exe2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1360-66-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-57-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-67-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-69-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-60-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-62-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-64-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-77-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-78-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-55-0x00000000001B0000-0x00000000002AA000-memory.dmpFilesize
1000KB
-
memory/1360-58-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-70-0x00000000004022F8-mapping.dmp
-
memory/1360-72-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-73-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-75-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1360-76-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/1604-65-0x00000000002D0000-0x00000000002D4000-memory.dmpFilesize
16KB
-
memory/1604-54-0x0000000075A81000-0x0000000075A83000-memory.dmpFilesize
8KB