Overview

overview

10

Static

static

go.exe

windows7_x64

7

go.exe

windows10_x64

10

Resubmissions

11/05/2020, 15:26

200511-xt1564wyhj 10

05/05/2020, 23:59

200505-rl298pza1a 10

Analysis

  • max time kernel
    128s
  • max time network
    224s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    05/05/2020, 23:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    go.exe

  • Size

    2.5MB

  • MD5

    f7508239b937b2427649be8f77718f60

  • SHA1

    ae85ece228d81f1b4cc8203bab4a8a2e45c2dc05

  • SHA256

    fa7465ff52d0725c0ce446ca4f1686a3912c5117e7e37d87c5c4c013ec629599

  • SHA512

    005a8cb1408d1049cf7926309bc7bf17689588b8804defd99dbfced6c36795faab4559320dc71d59f5259c7858bdb032d88c83c56f6cde2e9d9f0d28f8f1a66f

Score
7/10
spyware

Malware Config

Signatures

  • Makes http(s) request 35 IoCs

    Contacts server via http/https, possibly for C2 communication.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Checks whether UAC is enabled 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
    adwarespyware
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\go.exe
    "C:\Users\Admin\AppData\Local\Temp\go.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe url.dll,FileProtocolHandler https://google.com/
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://google.com/
        3⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        PID:1924
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
          4⤵
          • Checks whether UAC is enabled
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:108
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe url.dll,FileProtocolHandler C:\Users\Admin/Desktop/LEEME.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LEEME.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1172

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads