Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
a69b0516cb39875b649aa5003b8ccadb.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a69b0516cb39875b649aa5003b8ccadb.exe
Resource
win10v2004-20230703-en
General
-
Target
a69b0516cb39875b649aa5003b8ccadb.exe
-
Size
693KB
-
MD5
a69b0516cb39875b649aa5003b8ccadb
-
SHA1
b7a95ea33f8ea736f2d7f9f2d283250f49f02a43
-
SHA256
4ff2e8cb6e81b9946d403ee59271618620e4e55164d9b591be3d648425505185
-
SHA512
ad39347aab220a28b230d46303c1d4e2be059bba35e2116e064f7817b425199616e6bf6a512d5fd062b84f45573c1a0c032edc1578ea3b5dba776b88fdb490e2
-
SSDEEP
12288:/s2iN8JJnxqQ9zlTCtg9wziJ29PR4epgSzdaBPNZHcIxRGijvBNPjuF9T:/s1uJ5xV9xCt04iKHDEPNZNjvBNaF
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sOFvE = "C:\\Users\\Admin\\AppData\\Roaming\\sOFvE\\sOFvE.exe" a69b0516cb39875b649aa5003b8ccadb.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 51 api.ipify.org 52 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 180 set thread context of 2148 180 a69b0516cb39875b649aa5003b8ccadb.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2520 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 180 a69b0516cb39875b649aa5003b8ccadb.exe 180 a69b0516cb39875b649aa5003b8ccadb.exe 4944 powershell.exe 2148 a69b0516cb39875b649aa5003b8ccadb.exe 2148 a69b0516cb39875b649aa5003b8ccadb.exe 2148 a69b0516cb39875b649aa5003b8ccadb.exe 2148 a69b0516cb39875b649aa5003b8ccadb.exe 4944 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 180 a69b0516cb39875b649aa5003b8ccadb.exe Token: SeDebugPrivilege 4944 powershell.exe Token: SeDebugPrivilege 2148 a69b0516cb39875b649aa5003b8ccadb.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 180 wrote to memory of 4944 180 a69b0516cb39875b649aa5003b8ccadb.exe 97 PID 180 wrote to memory of 4944 180 a69b0516cb39875b649aa5003b8ccadb.exe 97 PID 180 wrote to memory of 4944 180 a69b0516cb39875b649aa5003b8ccadb.exe 97 PID 180 wrote to memory of 2520 180 a69b0516cb39875b649aa5003b8ccadb.exe 99 PID 180 wrote to memory of 2520 180 a69b0516cb39875b649aa5003b8ccadb.exe 99 PID 180 wrote to memory of 2520 180 a69b0516cb39875b649aa5003b8ccadb.exe 99 PID 180 wrote to memory of 2148 180 a69b0516cb39875b649aa5003b8ccadb.exe 101 PID 180 wrote to memory of 2148 180 a69b0516cb39875b649aa5003b8ccadb.exe 101 PID 180 wrote to memory of 2148 180 a69b0516cb39875b649aa5003b8ccadb.exe 101 PID 180 wrote to memory of 2148 180 a69b0516cb39875b649aa5003b8ccadb.exe 101 PID 180 wrote to memory of 2148 180 a69b0516cb39875b649aa5003b8ccadb.exe 101 PID 180 wrote to memory of 2148 180 a69b0516cb39875b649aa5003b8ccadb.exe 101 PID 180 wrote to memory of 2148 180 a69b0516cb39875b649aa5003b8ccadb.exe 101 PID 180 wrote to memory of 2148 180 a69b0516cb39875b649aa5003b8ccadb.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\a69b0516cb39875b649aa5003b8ccadb.exe"C:\Users\Admin\AppData\Local\Temp\a69b0516cb39875b649aa5003b8ccadb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GiIuupIgJvGLsQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GiIuupIgJvGLsQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp244C.tmp"2⤵
- Creates scheduled task(s)
PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\a69b0516cb39875b649aa5003b8ccadb.exe"C:\Users\Admin\AppData\Local\Temp\a69b0516cb39875b649aa5003b8ccadb.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5c8c8061675ae76b0491e27238df49ed2
SHA1b03ce7c8bd360d37b234076d5fba67284e28a460
SHA2562a7a8508d9afbfc8a1b185e31fc1115252c225bedafff462d3c97e69ad20944d
SHA51208a01406778e58c49c68404e8fe3b5e61c1af9246e3d24f019c46bcf1bec7d71a28ef139873b015bb3df3e68479b7b8e19c6b882cdc8f02d93af0a4a975da89b