Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 03:07
Behavioral task
behavioral1
Sample
19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe
-
Size
634KB
-
MD5
93c4bff9626c9d99fb00531ed8d7e1ff
-
SHA1
cb950862e5ca6cf07a9c8d96f089d31a82b3c2b8
-
SHA256
19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc
-
SHA512
d5a0bd11700f43e2f0ec67fd0e44ac56d9057cb396597ed18655b5ff855b8261bc5556d12474b3cfda5d7aefc616db28bdbcca183d882a501bbaca1399bdc226
-
SSDEEP
6144:AKsvTseilCBdfRJ/M+l1Lf0/B1usvJR3djOuY0yKzOI2K9/6OyRiy+n9jl4NnzIU:3svTyUpy+YJRdOeyuOI2DzLNnEVq
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1808-55-0x0000000001000000-0x00000000010C8000-memory.dmp upx behavioral1/memory/1808-96-0x0000000001000000-0x00000000010C8000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\L: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\M: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\N: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\V: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\E: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\F: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\G: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\Z: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\S: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\T: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\U: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\W: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\Y: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\J: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\O: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\P: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\Q: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\R: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\X: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\I: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened (read-only) \??\K: 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\locator.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File created \??\c:\windows\SysWOW64\dllhost.vir 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File created \??\c:\windows\SysWOW64\svchost.vir 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File created \??\c:\windows\SysWOW64\searchindexer.vir 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File created \??\c:\windows\SysWOW64\msiexec.vir 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File created C:\Program Files\7-Zip\Uninstall.vir 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{BF7F1E1C-D735-4F56-A959-D5DF03F4B1CA}.crmlog dllhost.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File opened for modification \??\c:\windows\ehome\ehsched.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{BF7F1E1C-D735-4F56-A959-D5DF03F4B1CA}.crmlog dllhost.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1808 19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe Token: 33 1512 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1512 AUDIODG.EXE Token: 33 1512 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1512 AUDIODG.EXE Token: SeRestorePrivilege 1272 msiexec.exe Token: SeTakeOwnershipPrivilege 1272 msiexec.exe Token: SeSecurityPrivilege 1272 msiexec.exe Token: SeManageVolumePrivilege 596 SearchIndexer.exe Token: 33 596 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 596 SearchIndexer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 572 SearchProtocolHost.exe 572 SearchProtocolHost.exe 572 SearchProtocolHost.exe 572 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 596 wrote to memory of 572 596 SearchIndexer.exe 31 PID 596 wrote to memory of 572 596 SearchIndexer.exe 31 PID 596 wrote to memory of 572 596 SearchIndexer.exe 31 PID 596 wrote to memory of 1844 596 SearchIndexer.exe 32 PID 596 wrote to memory of 1844 596 SearchIndexer.exe 32 PID 596 wrote to memory of 1844 596 SearchIndexer.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe"C:\Users\Admin\AppData\Local\Temp\19d1162da149ac46ce0acbdacdf9a0b334d5a49eed3e1c34f7d465de05ca13bc.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x47c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:1248
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2292972927-2705560509-2768824231-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2292972927-2705560509-2768824231-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:572
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 5202⤵PID:1844
-