Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 17:15
Behavioral task
behavioral1
Sample
a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe
Resource
win7-20220901-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe
-
Size
340KB
-
MD5
00b9301df7598dba149f6ac247b32d3a
-
SHA1
50cfaff169ef83cbaafe9e60383f063504f320b7
-
SHA256
a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d
-
SHA512
253ebe8ea0b0aaece48c4e432aef9e4a21c6bbc766ef2ec546e97f4b08d762940411e6b35e2435b614942155ba12123d39475710b0e716d4438df0f85ffec36f
-
SSDEEP
6144:3JRFTYCpsu2v3BGRUyqinBazIVDNPHRCHZS/sC/X8prJvhdujyu:5h8vgUknBasVDN5C5S/szpdueu
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Drivers\Dbgv.sys a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\DBGV\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\Dbgv.sys" a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\DBGV\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Dbgv.sys" a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe -
resource yara_rule behavioral1/memory/1444-55-0x0000000000400000-0x000000000048F000-memory.dmp upx behavioral1/memory/1444-96-0x0000000000400000-0x000000000048F000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\L: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\M: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\N: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\Q: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\Y: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\E: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\P: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\R: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\U: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\V: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\G: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\J: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\K: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\S: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\Z: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\F: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\O: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\T: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\W: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\X: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened (read-only) \??\I: a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File created \??\c:\windows\SysWOW64\dllhost.vir a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File created \??\c:\windows\SysWOW64\msiexec.vir a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File created \??\c:\windows\SysWOW64\svchost.vir a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File created \??\c:\windows\SysWOW64\searchindexer.vir a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\7-Zip\7z.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\7-Zip\7zG.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File created C:\Program Files\7-Zip\Uninstall.vir a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\ehome\ehsched.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{52FF8992-55CE-4ECE-9775-2FBA643A9843}.crmlog dllhost.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{52FF8992-55CE-4ECE-9775-2FBA643A9843}.crmlog dllhost.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1444 a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 1444 a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe 1444 a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeLoadDriverPrivilege 1444 a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe Token: SeLoadDriverPrivilege 1444 a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe Token: SeTakeOwnershipPrivilege 1444 a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe Token: SeSecurityPrivilege 1920 msiexec.exe Token: SeManageVolumePrivilege 536 SearchIndexer.exe Token: 33 536 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 536 SearchIndexer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1480 SearchProtocolHost.exe 1480 SearchProtocolHost.exe 1480 SearchProtocolHost.exe 1480 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 536 wrote to memory of 1480 536 SearchIndexer.exe 30 PID 536 wrote to memory of 1480 536 SearchIndexer.exe 30 PID 536 wrote to memory of 1480 536 SearchIndexer.exe 30 PID 536 wrote to memory of 1536 536 SearchIndexer.exe 31 PID 536 wrote to memory of 1536 536 SearchIndexer.exe 31 PID 536 wrote to memory of 1536 536 SearchIndexer.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe"C:\Users\Admin\AppData\Local\Temp\a6ecbeda859b4b350ba255b1e74db1f949a376b0cba97364ba44e13696411b5d.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:844
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 5202⤵PID:1536
-