Analysis
-
max time kernel
154s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 08:31
Static task
static1
Behavioral task
behavioral1
Sample
yxrp7aBc7KHBCsk.exe
Resource
win7-20220812-en
General
-
Target
yxrp7aBc7KHBCsk.exe
-
Size
1.1MB
-
MD5
48ab3af9d46affb38d6bba63215f606f
-
SHA1
5a5f9ddc5cf46787a03c8cefe1c038274b69f2eb
-
SHA256
0b064f0ef5c1fc97add6a750c3166edc03d6ebbcf0ed5b0e36cec598ff2e301e
-
SHA512
7eea0bfbd69f74003a5a24c6ae9cfcb13321454e932bee8026a6ef636e5ad9750aff3b081b6f3bd031578c600df9e3e2a6f0122551540aa23f5ec174bae33647
-
SSDEEP
24576:0ufO+8zjZ1dSvam6fNgyDh1u7hDi7hdqkMzjVfr:nz8zjZbSz6Vy7UT5OJfr
Malware Config
Extracted
formbook
cqd8
9zPItsSBQPthH0B1
iyz2ugC7TUMEaZEDDTNIzw==
uVc25zCFO03zbYzHxXLElk5HHccFoes=
RYDZw1su7yszucXjwqtgrz1tSccFoes=
AiB+KfBdDLRFs8sOAsmAllKZeg==
w5T7/Y1lNGBeMdKkKNl8tUl3fTWjlURG
mcIHqPCaEavSyg==
YA7dyN6xKf1MKJa/RA==
Dt789IRVd/fO8FeQNOiV3g==
jYfu3dS4b/1OL59exnPPEo4=
SjyOSKD6lRhpWwUmMwE8ncB1KOg=
JIT782/TaO41DXw3hYJa1g==
uT4u7SwA+3yA/iCo0O7tHyeffA==
/gJzPfngDySzwndmyHPPEo4=
+Um8wD7b9bCQ8A9cK4Nl1oA=
RaikVqx5ozxW3vd6khgIHsDMgKrv
hyYEyRMIEJ8WdnFePeLgHyeffA==
bCov6raFJ30odm5fJQQ=
1rMMrXrTf7OZqyLVM708wZ0=
U4nspOC6sJ3et2I=
Amsy4i4MxPTrXYWeojyK
qqYLwgp2O/CAx73ntWL3DLmD
v+o9+ruZZv5gEuvofQ4=
Q2TEpDYKHJSOCCGbqS91tm+gZCM193JQ
myoIxQ/iiohHn17RlzWI
rzQd05nrgI907Re4QPfYHyeffA==
QkC8sCmTTfZrZLz5hAw=
t5r3o/G/cZ+vdu+g+oMEE8B1KOg=
C0u8wFktz793xKe4jnATIMyJ
TjKaV5ZbDyQHOJcUcFCC
djpCCcmZXwlBpMPyIUZf3A==
Un779oxhdgtHI8SnDdcOIJc=
YKgTvQjejYw4pbqeojyK
KBd0a2BKX1jU15Ctom33DLmD
aZ7/sQblqNS+Nla7AauEB8sNyUDm9Cki3A==
zJhnWWws5JL973c6hYJa1g==
gb0n1xj1K9MC+ad0z3Q9RRUT7+A=
0sQMsgbWCJyyZFPrSA==
20IjpORM6MDYxQ==
N2y7vVIlDbMG+AQ9Xw==
agEIEhBjAg3OQ16NYNzfakfMbRKp7w==
wDsU0Rr/6MDYxQ==
NTeghQ12G3s0MZTduZkswZ8=
L97Zk19BYXUZfWlr/Hbj7Vt5T8cFoes=
YHzblVUr2IQblbeeojyK
NWrc623LYOxVqMvtvtcOIJc=
Dop0ZWnNM31cvnASfhs=
cKw08CYD6MDYxQ==
lz8u3baYpK4zHYw3hw6iJc3MgKrv
0Z9yXF01VUO1A/rtvHT3DLmD
7IxuWmMwLzEGXXr7TPzbHyeffA==
S+IyyYGNQ+w=
OWLEsDwEJcYYEcOg8Jv2NZ0=
hpoR35NpipozlYN/D8SS7rT7bRKp7w==
mZgB83regxFgYgTmbOhb3LW2m5Sa02tO
P4jc4mGzUuhRSebNpG73DLmD
rjMAwp8+nZxq
t9Ab0ZFjaHgssun2RiGA
CEKgRx1lGCe1DvvzfjFHWAGQNu4=
295oZvzAc4xt4wVshYJa1g==
+f5vXOqxxTQWorueojyK
CMKeTBzmgQ+IlQgskhU=
2lhYTVMvVGIRj7GeojyK
BCq+UU4+nZxq
tornoallavita.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
cmstp.exeflow pid process 44 116 cmstp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
yxrp7aBc7KHBCsk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation yxrp7aBc7KHBCsk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
yxrp7aBc7KHBCsk.exeyxrp7aBc7KHBCsk.execmstp.exedescription pid process target process PID 4900 set thread context of 3420 4900 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 3420 set thread context of 2456 3420 yxrp7aBc7KHBCsk.exe Explorer.EXE PID 116 set thread context of 2456 116 cmstp.exe Explorer.EXE -
Processes:
cmstp.exedescription ioc process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
yxrp7aBc7KHBCsk.execmstp.exepid process 3420 yxrp7aBc7KHBCsk.exe 3420 yxrp7aBc7KHBCsk.exe 3420 yxrp7aBc7KHBCsk.exe 3420 yxrp7aBc7KHBCsk.exe 3420 yxrp7aBc7KHBCsk.exe 3420 yxrp7aBc7KHBCsk.exe 3420 yxrp7aBc7KHBCsk.exe 3420 yxrp7aBc7KHBCsk.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe 116 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
yxrp7aBc7KHBCsk.execmstp.exepid process 3420 yxrp7aBc7KHBCsk.exe 3420 yxrp7aBc7KHBCsk.exe 3420 yxrp7aBc7KHBCsk.exe 116 cmstp.exe 116 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
yxrp7aBc7KHBCsk.execmstp.exedescription pid process Token: SeDebugPrivilege 3420 yxrp7aBc7KHBCsk.exe Token: SeDebugPrivilege 116 cmstp.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
yxrp7aBc7KHBCsk.exepid process 4900 yxrp7aBc7KHBCsk.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
yxrp7aBc7KHBCsk.exepid process 4900 yxrp7aBc7KHBCsk.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
yxrp7aBc7KHBCsk.exeExplorer.EXEdescription pid process target process PID 4900 wrote to memory of 3420 4900 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 4900 wrote to memory of 3420 4900 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 4900 wrote to memory of 3420 4900 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 4900 wrote to memory of 3420 4900 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 4900 wrote to memory of 3420 4900 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 4900 wrote to memory of 3420 4900 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 2456 wrote to memory of 116 2456 Explorer.EXE cmstp.exe PID 2456 wrote to memory of 116 2456 Explorer.EXE cmstp.exe PID 2456 wrote to memory of 116 2456 Explorer.EXE cmstp.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yxrp7aBc7KHBCsk.exe"C:\Users\Admin\AppData\Local\Temp\yxrp7aBc7KHBCsk.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yxrp7aBc7KHBCsk.exe"C:\Users\Admin\AppData\Local\Temp\yxrp7aBc7KHBCsk.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/116-155-0x0000000000920000-0x000000000094D000-memory.dmpFilesize
180KB
-
memory/116-153-0x0000000002A80000-0x0000000002B0F000-memory.dmpFilesize
572KB
-
memory/116-152-0x0000000002B20000-0x0000000002E6A000-memory.dmpFilesize
3.3MB
-
memory/116-151-0x0000000000920000-0x000000000094D000-memory.dmpFilesize
180KB
-
memory/116-150-0x0000000000ED0000-0x0000000000EE6000-memory.dmpFilesize
88KB
-
memory/116-147-0x0000000000000000-mapping.dmp
-
memory/2456-146-0x00000000080E0000-0x000000000825C000-memory.dmpFilesize
1.5MB
-
memory/2456-156-0x00000000070C0000-0x000000000718D000-memory.dmpFilesize
820KB
-
memory/2456-154-0x00000000070C0000-0x000000000718D000-memory.dmpFilesize
820KB
-
memory/3420-149-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3420-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3420-145-0x0000000000FA0000-0x0000000000FB0000-memory.dmpFilesize
64KB
-
memory/3420-142-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3420-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3420-148-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3420-138-0x0000000000000000-mapping.dmp
-
memory/3420-144-0x0000000001510000-0x000000000185A000-memory.dmpFilesize
3.3MB
-
memory/4900-132-0x0000000000F80000-0x00000000010A2000-memory.dmpFilesize
1.1MB
-
memory/4900-137-0x0000000001690000-0x00000000016F6000-memory.dmpFilesize
408KB
-
memory/4900-136-0x0000000009460000-0x00000000094FC000-memory.dmpFilesize
624KB
-
memory/4900-135-0x0000000005A40000-0x0000000005A4A000-memory.dmpFilesize
40KB
-
memory/4900-134-0x0000000005A70000-0x0000000005B02000-memory.dmpFilesize
584KB
-
memory/4900-133-0x0000000006020000-0x00000000065C4000-memory.dmpFilesize
5.6MB