Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 19:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36529715f030b1ace102cac4bad286fd.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
General
-
Target
36529715f030b1ace102cac4bad286fd.exe
-
Size
7.6MB
-
MD5
36529715f030b1ace102cac4bad286fd
-
SHA1
5f780ea7c3d360bd7aa44dc8364971ec13baba93
-
SHA256
0a7a6c113cec0d57880d0d1622e09ce0cbea9e6d1341e34ae2dcb7953793d203
-
SHA512
4548039481aeecfbc3d5368d32a1f0b8608ce10f13b4d10711dc6b1db1ae1de454c908a1d04f412e180470c6a9cf1e6fa840e277f838a122b6dd5a319ee8d02b
-
SSDEEP
196608:gzDmx0ifW2jZYL54zZ9UntTdRY2JECvGKvDKCcwyouRwk2OGQXQxzZ:gukk/aRJJEC5i5lgxzZ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1040 servbrow.exe 4624 servbrow.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 29 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\sslnavcancel[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\navcancl[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\errorPageStrings[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\httpErrorPagesScripts[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\info_48[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771 servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\navcancl[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\bullet[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\background_gradient[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\sslnavcancel[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\ErrorPageTemplate[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\errorPageStrings[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\httpErrorPagesScripts[1] servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\info_48[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\bullet[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F494F30B61C055FEC5A21FF784EF884B_6B174BF33CC3377014225BEBC9418D9A servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\ErrorPageTemplate[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\background_gradient[1] servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F494F30B61C055FEC5A21FF784EF884B_6B174BF33CC3377014225BEBC9418D9A servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771 servbrow.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\Ws2Help.dll 36529715f030b1ace102cac4bad286fd.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll 36529715f030b1ace102cac4bad286fd.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll 36529715f030b1ace102cac4bad286fd.exe File created C:\Program Files\7-Zip\Ws2Help.dll 36529715f030b1ace102cac4bad286fd.exe File opened for modification C:\Program Files\7-Zip\Ws2Help.dll 36529715f030b1ace102cac4bad286fd.exe File created C:\Program Files\VideoLAN\VLC\Ws2Help.dll 36529715f030b1ace102cac4bad286fd.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\servbrow.exe 36529715f030b1ace102cac4bad286fd.exe -
Modifies data under HKEY_USERS 16 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft servbrow.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeTcbPrivilege 1040 servbrow.exe Token: SeChangeNotifyPrivilege 1040 servbrow.exe Token: SeIncreaseQuotaPrivilege 1040 servbrow.exe Token: SeAssignPrimaryTokenPrivilege 1040 servbrow.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2988 36529715f030b1ace102cac4bad286fd.exe 1040 servbrow.exe 4624 servbrow.exe 4624 servbrow.exe 4624 servbrow.exe 4624 servbrow.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1040 wrote to memory of 4624 1040 servbrow.exe 105 PID 1040 wrote to memory of 4624 1040 servbrow.exe 105 PID 1040 wrote to memory of 4624 1040 servbrow.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\36529715f030b1ace102cac4bad286fd.exe"C:\Users\Admin\AppData\Local\Temp\36529715f030b1ace102cac4bad286fd.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2988
-
C:\Windows\servbrow.exe"C:\Windows\servbrow.exe" /Service1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\servbrow.exe"C:\Windows\servbrow.exe" /Popup2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5cf8a3aec1d1c05be8497d3a838af9e9d
SHA1d8489eade82cf81827d5c38f6a8dfcfbeb5e3d58
SHA256b02d4e3aa80ccc798dfd1e56b7e7e753e2928306864ebd64bab766bdea93276a
SHA51210f009ba96e043ac45fad50f39104fd81d5b4e62b280b14b9727cbebdb2b33d58067e12e5d7478d60212d1149c4f0db95055a380ea48aec06481c9d2839882ef
-
Filesize
6.7MB
MD544e406bc1a062fd27477f002f78d4bca
SHA17a6633218f7f01fb365c85721a5950499978d0c4
SHA256dbc7fa9a9d1aae40718c35218d2e9f792f920eb40a1334982a12ed1cea8ed241
SHA512284361fc26a8fe885731e3d5f2976150e70599927d70523f85e6afd139c304c7c255048ddca7e55170b54dd21c40a9e1cd44e1fe1152e4390d2146c0887f83c1
-
Filesize
7.6MB
MD51fd2c6ab96c0a2d5fdbfa465afa677a0
SHA108c68a1bc8bc1a5a1aefbf9f84fe01ed24ecd2db
SHA2561347be3852e519d0cbbbd52fda5b6e2ddd16a4eeaa8a7220dc540eaa8e9a727e
SHA512298f2cba7f39a5f143632484e011e2173e2489a7fe9c04aa43f97b79dabafbd90d05970b255cbeb6f442fe559638f3b029da10641e4fba43abdc3012766a6f32