Analysis
-
max time kernel
187s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 06:38
Static task
static1
Behavioral task
behavioral1
Sample
wininfo32/lib64.exe
Resource
win7-20220812-en
General
-
Target
wininfo32/lib64.exe
-
Size
202KB
-
MD5
676380743dd23f61e18c1e044105168a
-
SHA1
387fbee19170c2ddc8c4faa2b38131fe9b3259de
-
SHA256
d8b2ccbb31253f78340e5a95ac72cb871e52338526817cc5db09107becaf7b36
-
SHA512
685d3bf901993ddec9a786132f1f9e9b48c6d8697fdce67f26813b0e1d1b1b2419d37db35c43829578255b51d80877a243b395d2a4423eef4174b5168dfc8b14
-
SSDEEP
6144:qxAVDI/PTDCC4vX7NYEpItOeDwh0UkezRpt:qxAVD6Pn0v+EaOeDo0yzRT
Malware Config
Extracted
formbook
s3f0
zm/xqaOkp7SIM6I9k8cYYQ==
R3BJUiYhIJsD50TcNbbEexs=
r92WbDh7DjlsCftKuG56
UmoUBecGa6YL6A==
UQLQ4AmN+i0R
ATNkzEHBHyMM
BSHJi2n11k/Oq+6Mug==
+Z7elo1OY5UH6Q==
dZEf25y+5WLNqDGY9DI=
Zu6ipAkOo1QGo6fHrw==
iquKhUajLOlfLDduk8cYYQ==
6HcbD4jxPzcS
kCkEGSRmmQVzS1l7k8cYYQ==
kpV9fdfeZ3ZO/ozTsg==
Vea2yr7h+HTYxwHH9C8=
j7h4fHeMuGfayAHH9C8=
tcQ2/YKFQAFqYKxQfu09Rjl6FA==
RVYC2MYEERU2x8sXLiY=
dv+nDEaN+i0R
CbNkLJj8EFE0Hmn/LSeqpVhnTmJs
+ZEOpoOkxECzic912Y8PShp8Aw==
a0RqKQgbY5UH6Q==
r8V+RgNeIIkBjs3ZsQ==
7Qv6BWh/PARjOnwukALFRQI=
MUUVLrgDSk8zDkSM8+Vr
GzbbrHzx8TsG
HKl5kIqcyQf+5PcjBw1LgSt2
OeGPjRA81MyxjxlMIjg=
ModfBJr4pVI9HDU=
WxEkl1ieterVowJWOqwntZa8jK4=
5A+whwjta6QR8A==
ITMeM7j1ophzQ1lv4+xedg==
mMRuTEalMPNTPIYLZh+mLvlU+oyOCxOwfg==
Nrowi6Wgx3HlvAxnk8cYYQ==
VdxwOYbxSz8O/g==
MsFyPR9WdOdW/ozTsg==
cnUhYEcPQ4nuzA6Sug==
nkIK4UmbRz8xCh5CNCFyL+9LEqmUCxOwfg==
Ib0g7nBq49zFnOx+uLQtIdI07P/DGB2Q
tmM4VN0U2uIG3/5O
ZQGERYSVSgxiQ2GHu/ZCeA==
fxTMo6QIqrqdeoigPvxIfA==
OlPprpwDnsy9g7UMvu9y
E+56QVJyxgiuTE6Kug==
ydqQfADocyDUZa5L
n0W9d8X4os55RTw=
cBHV2GKtsOfafu+VpQ==
1HQCWd878ufauAHH9C8=
jrFRNQz6Id5PFWD9La3wdpa8jK4=
jy+7SS06N7ci7UKXgvJDaQdWJXhYiA==
11cuU20ltrJKPys=
BqUx71KxwGPeq/ST8Koytpa8jK4=
NkrsRrjtns55RTw=
sUj218/A3SEa3irUPLbEexs=
t1f0viixHSUM
x2PtpvQs2si/h81ThvE4Rjl6FA==
UPnS6Eg3yIDesbng0j6OtU/X1cByfdE=
uGtfm4RJY5UH6Q==
+5FJF/1Ozoro1QHH9C8=
PVcAup3f+jI=
9Ik+OaG4Qzgj9jagPvxIfA==
sUkveHFEY5UH6Q==
kCuqZrX8CrQW+ghcwwNBBbYk4vvDGB2Q
bJpcLRmx+yMO
worldhealthfoodfair.com
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
cmstp.exeflow pid process 7 980 cmstp.exe 25 980 cmstp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lib64.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation lib64.exe -
Loads dropped DLL 1 IoCs
Processes:
cmstp.exepid process 980 cmstp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
lib64.execmstp.exedescription pid process target process PID 480 set thread context of 1208 480 lib64.exe Explorer.EXE PID 980 set thread context of 1208 980 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
cmstp.exedescription ioc process Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
lib64.execmstp.exepid process 480 lib64.exe 480 lib64.exe 480 lib64.exe 480 lib64.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
lib64.execmstp.exepid process 480 lib64.exe 480 lib64.exe 480 lib64.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
lib64.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 480 lib64.exe Token: SeDebugPrivilege 980 cmstp.exe Token: SeShutdownPrivilege 1208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Explorer.EXEcmstp.exedescription pid process target process PID 1208 wrote to memory of 980 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 980 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 980 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 980 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 980 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 980 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 980 1208 Explorer.EXE cmstp.exe PID 980 wrote to memory of 968 980 cmstp.exe Firefox.exe PID 980 wrote to memory of 968 980 cmstp.exe Firefox.exe PID 980 wrote to memory of 968 980 cmstp.exe Firefox.exe PID 980 wrote to memory of 968 980 cmstp.exe Firefox.exe PID 980 wrote to memory of 968 980 cmstp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wininfo32\lib64.exe"C:\Users\Admin\AppData\Local\Temp\wininfo32\lib64.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
810KB
MD5c6ec991471d42128268ea10236d9cdb8
SHA1d569350d02db6a118136220da8de40a9973084f1
SHA2561b755cc3093dd45a0df857854aedfeb3c8f3622cff5bc491f2d492ebfa3ef8e0
SHA512a67ed46547b9270c8a5a7a947b375cb6baf3211072f90170aae2bb6ce9c4fe9d7be3e9d782420dcfdbc19a1f232b3be561ca503b80e8dc3e036a62c54cad5b57
-
memory/480-54-0x0000000000960000-0x000000000098F000-memory.dmpFilesize
188KB
-
memory/480-55-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/480-56-0x0000000000110000-0x0000000000120000-memory.dmpFilesize
64KB
-
memory/480-57-0x0000000000960000-0x000000000098F000-memory.dmpFilesize
188KB
-
memory/980-60-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/980-59-0x0000000000000000-mapping.dmp
-
memory/980-61-0x0000000000D70000-0x0000000000D88000-memory.dmpFilesize
96KB
-
memory/980-62-0x00000000000F0000-0x000000000011D000-memory.dmpFilesize
180KB
-
memory/980-63-0x00000000009D0000-0x0000000000CD3000-memory.dmpFilesize
3.0MB
-
memory/980-64-0x00000000007C0000-0x000000000084F000-memory.dmpFilesize
572KB
-
memory/980-66-0x00000000000F0000-0x000000000011D000-memory.dmpFilesize
180KB
-
memory/1208-65-0x0000000007260000-0x00000000073B3000-memory.dmpFilesize
1.3MB
-
memory/1208-67-0x0000000007260000-0x00000000073B3000-memory.dmpFilesize
1.3MB
-
memory/1208-58-0x00000000049D0000-0x0000000004B00000-memory.dmpFilesize
1.2MB