Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 02:39
Static task
static1
Behavioral task
behavioral1
Sample
0x0007000000013a3b-63.exe
Resource
win7-20220812-en
General
-
Target
0x0007000000013a3b-63.exe
-
Size
1.0MB
-
MD5
4960f9773333e5239226ca3a86e974e9
-
SHA1
a5eefef24d0586abd0457acb6cb8246057574d67
-
SHA256
6d62d493cae6daf08828e14fc36c0dba18e7eb7f75ca390ec5d21ae0b3d2c9a3
-
SHA512
4292c12fb5ac12e2d70c0849fc0697319faeea35123d435a597753de4cf801b4ef219940080d5484dca16a1a1c2ec771b73d030b37b5b93e79610dafec51ac2c
-
SSDEEP
12288:SvE7XguFSxqtLAWaDjb9fyxZqZKa5aRW4+QlpYidxDF/3gKavwI0iVWErqsM1pnU:H5KjZwZNxRL9dPPgrYI0Iomd+zrE
Malware Config
Extracted
formbook
h9nc
b6D0eLl/P/Ry1A==
KnXQBVoh1YK69G/dNR0pblRJIg==
WnXFkXyACqjtAumHng==
G0eU+2nD4Hul/C12
7TSYGZRY3obqxfiSusm2GLKO7zs=
rKv1H4dXCeB4dIWkDod0
kJHsAWgJMtQx2XbWOE50pGw=
9glV052OFiKdAumHng==
xiWAGAArojjC4Qlwk7dsq4N+0GTOyTQ=
1dUgKYkXDs1c54VvhAC4IL0a4DY=
//E2NG867Y/MH8x206eKnQ==
BQd1aNJsP/Ry1A==
kOMaJH4YPB4903g=
zOhJx2nSgFXV
3OUrp42pL88bb/+B06eKnQ==
bM5EoP21XTZ7psNQgQ==
BWG/kYrHtD9dmyigBbFamA==
BRlnZVmlrU14Zo/6Nmr9dVxHIg==
4fdR0rjKc0t78Ww/Z0DQAMWm9Ts=
Lh9p82obtozdHSNv
lNUaqpSrXwMdUc1TdaSKxa0WdIB7xyo=
Jfv1aOt2P/Ry1A==
9RFxryn/s1m33fwfVvurC+BQ
c6L/NfnfcmQVBidy
IwZr6WUt6Yzm5fp3k7nR79C7Gpt1L+zu
PzJ1aa8VApHYcxe85PoANdsEZbJIiDw=
Cj6P3zqt7I+qY2uNsFNp2GO9MA==
PjyOHAAowmy88JFehDPO1XOodDM=
m64VV89EYgSDqbm157g8gWQ=
Iyp0+47zDd0i3PXkQnINEeFY
sQ6JpCC47MQX197j/3kvVuc7Us7Y
goHTa19x9WPaVerf+aOOznOodDM=
AwVjGBYO0m+QUcqc2ujb42+ceTk=
wQts8Hg5w2bsFthdhw==
pAhh4cYTNVJMqWE=
eHyIyYoPP9c/UoDP9x6sHbrc67uARQ==
bagIBQZOdFJMqWE=
dscX0dXIONgaAiiL0G9DTyx9VKNY4tSZaw==
HTSGGBIgliRWO2fO8w3EwppxzmTOyTQ=
jh8daSkx3w5V33w=
7h1hP0gR2Ge/jfNge7HB1nOodDM=
JmPQVL489nyeZWc=
Ig9cltmVsVfX
i9A0MyFpMg42W+zR8bg8gWQ=
6xdyifmhZpStPkKBiQ==
EkGI/uT/kClyYYWkDod0
OH/jVUJmj5PHc24=
X4ToZ0Cj1YC8cJSkDod0
opvvM75CckmLqJequuJ8
DyKGSUE5rTdnS3He8yQ+vE7IKg==
oqsSU7yA6PeOk5akDod0
lbsZ/eIvKOQkWtlgiLaFKaUPLnI3tS3m
RG7b5kf0yIzdHSNv
MUeqMu81K6+PLdh+nA==
0f5g9W0Snjd+vEf9Kd2ltXzbxk67fUDr
iOY0RqASON32xvtLgP6rC+BQ
r5r8Tno79xZP2Xw=
C2feL3Ydu47dHSNv
P4vDZVoRl190ww==
JTGFJBhFy2OG75+q5Lg8gWQ=
4CuLhc5LfVCoepFs342Lig==
9NY7E/dLeUfLVP/c8Lg8gWQ=
Dymc5lrH9wog8idy
ARZkUEKJvZogxH9HZVCtt30=
joewhitepsychology.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0x0007000000013a3b-63.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 0x0007000000013a3b-63.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
0x0007000000013a3b-63.exe0x0007000000013a3b-63.exerundll32.exedescription pid process target process PID 4780 set thread context of 556 4780 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 556 set thread context of 2408 556 0x0007000000013a3b-63.exe Explorer.EXE PID 3536 set thread context of 2408 3536 rundll32.exe Explorer.EXE -
Processes:
rundll32.exedescription ioc process Key created \Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
0x0007000000013a3b-63.exerundll32.exepid process 556 0x0007000000013a3b-63.exe 556 0x0007000000013a3b-63.exe 556 0x0007000000013a3b-63.exe 556 0x0007000000013a3b-63.exe 556 0x0007000000013a3b-63.exe 556 0x0007000000013a3b-63.exe 556 0x0007000000013a3b-63.exe 556 0x0007000000013a3b-63.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2408 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
0x0007000000013a3b-63.exerundll32.exepid process 556 0x0007000000013a3b-63.exe 556 0x0007000000013a3b-63.exe 556 0x0007000000013a3b-63.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe 3536 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
0x0007000000013a3b-63.exeExplorer.EXErundll32.exedescription pid process Token: SeDebugPrivilege 556 0x0007000000013a3b-63.exe Token: SeShutdownPrivilege 2408 Explorer.EXE Token: SeCreatePagefilePrivilege 2408 Explorer.EXE Token: SeDebugPrivilege 3536 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0x0007000000013a3b-63.exeExplorer.EXErundll32.exedescription pid process target process PID 4780 wrote to memory of 556 4780 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 4780 wrote to memory of 556 4780 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 4780 wrote to memory of 556 4780 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 4780 wrote to memory of 556 4780 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 4780 wrote to memory of 556 4780 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 4780 wrote to memory of 556 4780 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 2408 wrote to memory of 3536 2408 Explorer.EXE rundll32.exe PID 2408 wrote to memory of 3536 2408 Explorer.EXE rundll32.exe PID 2408 wrote to memory of 3536 2408 Explorer.EXE rundll32.exe PID 3536 wrote to memory of 4308 3536 rundll32.exe Firefox.exe PID 3536 wrote to memory of 4308 3536 rundll32.exe Firefox.exe PID 3536 wrote to memory of 4308 3536 rundll32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\0x0007000000013a3b-63.exe"C:\Users\Admin\AppData\Local\Temp\0x0007000000013a3b-63.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\0x0007000000013a3b-63.exe"C:\Users\Admin\AppData\Local\Temp\0x0007000000013a3b-63.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:556 -
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:4424
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4308
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/556-149-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/556-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/556-144-0x00000000016A0000-0x00000000019EA000-memory.dmpFilesize
3.3MB
-
memory/556-145-0x00000000011C0000-0x00000000011D0000-memory.dmpFilesize
64KB
-
memory/556-148-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/556-142-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/556-138-0x0000000000000000-mapping.dmp
-
memory/556-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2408-156-0x00000000083C0000-0x000000000846F000-memory.dmpFilesize
700KB
-
memory/2408-146-0x0000000008260000-0x00000000083B3000-memory.dmpFilesize
1.3MB
-
memory/2408-154-0x00000000083C0000-0x000000000846F000-memory.dmpFilesize
700KB
-
memory/3536-151-0x0000000000670000-0x000000000069D000-memory.dmpFilesize
180KB
-
memory/3536-155-0x0000000000670000-0x000000000069D000-memory.dmpFilesize
180KB
-
memory/3536-153-0x0000000002440000-0x00000000024CF000-memory.dmpFilesize
572KB
-
memory/3536-147-0x0000000000000000-mapping.dmp
-
memory/3536-152-0x00000000025D0000-0x000000000291A000-memory.dmpFilesize
3.3MB
-
memory/3536-150-0x0000000000860000-0x0000000000874000-memory.dmpFilesize
80KB
-
memory/4780-137-0x00000000081B0000-0x000000000824C000-memory.dmpFilesize
624KB
-
memory/4780-132-0x0000000000A00000-0x0000000000B0A000-memory.dmpFilesize
1.0MB
-
memory/4780-136-0x00000000054D0000-0x00000000054DA000-memory.dmpFilesize
40KB
-
memory/4780-133-0x00000000059F0000-0x0000000005EBC000-memory.dmpFilesize
4.8MB
-
memory/4780-134-0x0000000005520000-0x00000000055B2000-memory.dmpFilesize
584KB
-
memory/4780-135-0x0000000006470000-0x0000000006A14000-memory.dmpFilesize
5.6MB