Analysis
-
max time kernel
69s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 08:52
Static task
static1
Behavioral task
behavioral1
Sample
b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe
Resource
win10v2004-20220812-en
General
-
Target
b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe
-
Size
436KB
-
MD5
6562d88856681e5e53c073f394e86da9
-
SHA1
d8b286bc2cbd0533e8a3f949d89fe51dc59237fe
-
SHA256
b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc
-
SHA512
f5eb75a02e7f2ae7cb044852f883c118b6af65ab09734ca2a97ef2ad275c659c03110d362ec33c0c774e7b695fb2a372050ce85bd4ca9f8ce9bfd1162e96d7f7
-
SSDEEP
12288:anc1wV3MIRTBOUg+LFYWSfWknbX22HZxDjpW2tS49:a2k3pR08LF4Fnbh5xrS
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 3024 0a131764.exe 4696 be45b969.exe 4496 93bc20e1.exe 1124 93bc20e1.exe 4928 93bc20e1.exe -
resource yara_rule behavioral2/memory/4496-149-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1124-153-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4928-159-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1124-158-0x0000000000400000-0x000000000044D000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe" 93bc20e1.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\physicaldrive0 be45b969.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 4696 be45b969.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2148 wrote to memory of 3024 2148 b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe 81 PID 2148 wrote to memory of 3024 2148 b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe 81 PID 2148 wrote to memory of 3024 2148 b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe 81 PID 2148 wrote to memory of 4696 2148 b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe 82 PID 2148 wrote to memory of 4696 2148 b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe 82 PID 2148 wrote to memory of 4696 2148 b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe 82 PID 2148 wrote to memory of 4496 2148 b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe 83 PID 2148 wrote to memory of 4496 2148 b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe 83 PID 2148 wrote to memory of 4496 2148 b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe 83 PID 4496 wrote to memory of 1124 4496 93bc20e1.exe 84 PID 4496 wrote to memory of 1124 4496 93bc20e1.exe 84 PID 4496 wrote to memory of 1124 4496 93bc20e1.exe 84 PID 4496 wrote to memory of 4928 4496 93bc20e1.exe 86 PID 4496 wrote to memory of 4928 4496 93bc20e1.exe 86 PID 4496 wrote to memory of 4928 4496 93bc20e1.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe"C:\Users\Admin\AppData\Local\Temp\b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\0a131764.exeC:\Users\Admin\AppData\Local\Temp\0a131764.exe2⤵
- Executes dropped EXE
PID:3024
-
-
C:\Users\Admin\AppData\Local\Temp\be45b969.exeC:\Users\Admin\AppData\Local\Temp\be45b969.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Users\Admin\AppData\Local\Temp\93bc20e1.exeC:\Users\Admin\AppData\Local\Temp\93bc20e1.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\93bc20e1.exeC:\Users\Admin\AppData\Local\Temp\93bc20e1.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming3⤵
- Executes dropped EXE
PID:1124
-
-
C:\Users\Admin\AppData\Local\Temp\93bc20e1.exeC:\Users\Admin\AppData\Local\Temp\93bc20e1.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp3⤵
- Executes dropped EXE
PID:4928
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD542a1116725b4302ffbee833e075e456b
SHA11244c20e427ff25c5efd8906d0b23f45b6208a3c
SHA256fc7b8edf44e4dd5d9010e1c5e8e1838eb6d78c4f71124ca53a6e57b2038a9387
SHA5123b79bd486a9379aad23e689a72c4ef44e6a2f1f45f23b8d644f2b9e421a0e152805928492bc649a8b478921301996ed65b87c317149fc5ae51b6eda3672ede01
-
Filesize
19KB
MD542a1116725b4302ffbee833e075e456b
SHA11244c20e427ff25c5efd8906d0b23f45b6208a3c
SHA256fc7b8edf44e4dd5d9010e1c5e8e1838eb6d78c4f71124ca53a6e57b2038a9387
SHA5123b79bd486a9379aad23e689a72c4ef44e6a2f1f45f23b8d644f2b9e421a0e152805928492bc649a8b478921301996ed65b87c317149fc5ae51b6eda3672ede01
-
Filesize
188KB
MD5a5384d4dd46646f9240a6d9cbabd499e
SHA14848cadc52ae8b9268c607dcfc2a8c4395190eda
SHA256c88e93fde1c75bf00eed15bba12eba227908b768b902af150212a9723826e9c1
SHA5124103996e5743d90e68df6aa919f172d22ed2df5de5533eb1195ee3cf1cb409378c0c8152703210b730f67f28a9df0f06eb2b2c2d0106dab22ae2660f6254d74b
-
Filesize
188KB
MD5a5384d4dd46646f9240a6d9cbabd499e
SHA14848cadc52ae8b9268c607dcfc2a8c4395190eda
SHA256c88e93fde1c75bf00eed15bba12eba227908b768b902af150212a9723826e9c1
SHA5124103996e5743d90e68df6aa919f172d22ed2df5de5533eb1195ee3cf1cb409378c0c8152703210b730f67f28a9df0f06eb2b2c2d0106dab22ae2660f6254d74b
-
Filesize
188KB
MD5a5384d4dd46646f9240a6d9cbabd499e
SHA14848cadc52ae8b9268c607dcfc2a8c4395190eda
SHA256c88e93fde1c75bf00eed15bba12eba227908b768b902af150212a9723826e9c1
SHA5124103996e5743d90e68df6aa919f172d22ed2df5de5533eb1195ee3cf1cb409378c0c8152703210b730f67f28a9df0f06eb2b2c2d0106dab22ae2660f6254d74b
-
Filesize
188KB
MD5a5384d4dd46646f9240a6d9cbabd499e
SHA14848cadc52ae8b9268c607dcfc2a8c4395190eda
SHA256c88e93fde1c75bf00eed15bba12eba227908b768b902af150212a9723826e9c1
SHA5124103996e5743d90e68df6aa919f172d22ed2df5de5533eb1195ee3cf1cb409378c0c8152703210b730f67f28a9df0f06eb2b2c2d0106dab22ae2660f6254d74b
-
Filesize
204KB
MD57bc8cbaeb146937037048e0d80abadd1
SHA199bfddc34d8583f20d39f5a3a52b527cfd852972
SHA2563aa82b190a5ab6cb6269b6a6d8474e54ba3ad28d6b03e3e65303a1828366cd6a
SHA5125597056e21545390a458c303849ba98fa36714fdd64ec781184f981d2654657ce0a7f12b502ab6290d0bbc3e2baf7f313f836f366185f0a47342c5dd1366cbcb
-
Filesize
204KB
MD57bc8cbaeb146937037048e0d80abadd1
SHA199bfddc34d8583f20d39f5a3a52b527cfd852972
SHA2563aa82b190a5ab6cb6269b6a6d8474e54ba3ad28d6b03e3e65303a1828366cd6a
SHA5125597056e21545390a458c303849ba98fa36714fdd64ec781184f981d2654657ce0a7f12b502ab6290d0bbc3e2baf7f313f836f366185f0a47342c5dd1366cbcb