Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 01:02
Static task
static1
Behavioral task
behavioral1
Sample
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe
Resource
win7-20220718-en
General
-
Target
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe
-
Size
1.5MB
-
MD5
09a4ebcec4652bc093ce7d022dc4147e
-
SHA1
364dc6e2491561bbc0135e4d7cdc54edb3d47bc4
-
SHA256
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d
-
SHA512
f0b8c69bacd7727370d83bb6bd67bda2a0a6427a92413d8c6bc7b11fe912ceb886e1bfc07cfb11d48a6fe82f7e4f69e7a53258854c1a2cf132afdedabc9ca9d4
Malware Config
Signatures
-
suricata: ET MALWARE Win32/Kelihos.F Checkin
suricata: ET MALWARE Win32/Kelihos.F Checkin
-
Processes:
resource yara_rule behavioral2/memory/3820-139-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral2/memory/3820-140-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral2/memory/3820-141-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral2/memory/3820-142-0x0000000000400000-0x000000000063E000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe" 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exepid process 3820 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exedescription pid process target process PID 4004 set thread context of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe -
Processes:
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FlagsModifiedValid = 0000000000000000 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe Set value (data) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DefaultCompressedRecord = c880f97f7319a171cf7c9a29bafbdb6a786a4aa8df6581d6f5220d69a0d3782d496a9129aea549fd16320730caff750ce322f66abb867f65438ec0e998b4f641ec0dbdebe018cc8af272e02891ff9ca6ac2d8d27ad677f9db50af195529ff94bc6fd7d15c05609 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RecordModifiedMax = "DFcO9W3fjpbBK0uoPkw0AeZvbPT6hKT5Lo+HU/ULZk6OqR1rGTJf9FJ2HiifPYLOPQ==" 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exepid process 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exepid process 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exedescription pid process target process PID 4004 wrote to memory of 4080 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 4080 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 4080 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 312 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 312 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 312 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe PID 4004 wrote to memory of 3820 4004 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe 5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe"C:\Users\Admin\AppData\Local\Temp\5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exeC:\Users\Admin\AppData\Local\Temp\5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exeC:\Users\Admin\AppData\Local\Temp\5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exeC:\Users\Admin\AppData\Local\Temp\5700f1f8f5e4ba09e5f683945d4384f8f5e72c1a54e8f2beb4bfe1de1a5fbd1d.exe2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/312-132-0x0000000000000000-mapping.dmp
-
memory/3820-136-0x0000000000400000-0x000000000063E000-memory.dmpFilesize
2.2MB
-
memory/3820-133-0x0000000000000000-mapping.dmp
-
memory/3820-134-0x0000000000400000-0x000000000063E000-memory.dmpFilesize
2.2MB
-
memory/3820-135-0x0000000000400000-0x000000000063E000-memory.dmpFilesize
2.2MB
-
memory/3820-137-0x0000000000400000-0x000000000063E000-memory.dmpFilesize
2.2MB
-
memory/3820-138-0x0000000000400000-0x000000000063E000-memory.dmpFilesize
2.2MB
-
memory/3820-139-0x0000000000400000-0x000000000063E000-memory.dmpFilesize
2.2MB
-
memory/3820-140-0x0000000000400000-0x000000000063E000-memory.dmpFilesize
2.2MB
-
memory/3820-141-0x0000000000400000-0x000000000063E000-memory.dmpFilesize
2.2MB
-
memory/3820-142-0x0000000000400000-0x000000000063E000-memory.dmpFilesize
2.2MB
-
memory/4004-130-0x0000000002330000-0x0000000002334000-memory.dmpFilesize
16KB
-
memory/4080-131-0x0000000000000000-mapping.dmp