7b09827c51efeac5d130c4ef923be8396ba28582a9601fefce7e02cfb115f3db

Analysis

max time kernel
67s
max time network
125s
platform
windows10_x64
resource
win10-en-20211014
submitted
21/10/2021, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Token Grabber V2.exe
Size 2.8MB
Sample211021-3nv35abham
SHA256 7b09827c51efeac5d130c4ef923be8396ba28582a9601fefce7e02cfb115f3db
MD5 6b307ce6d81d996461f475dd6cd85fe8
SHA1 8bfda2832dea95e0dfadbe9f1816c6fb70fba492
SHA512 4802e50f900f821aba0dfbfec7df324cd5747c329d46ac679d65378c05fea2e0780f8f4ae35480b68aee66081461b565be71645f0221fa332bbec3f3af190356
MD5 SHA1 SHA512

Score

9^/10

spyware stealer upx

Malware Config

Signatures

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1060-124-0x000002D1F5690000-0x000002D1F59CB000-memory.dmp	WebBrowserPassView
behavioral2/files/0x000400000001abaf-151.dat	WebBrowserPassView
behavioral2/files/0x000400000001abaf-152.dat	WebBrowserPassView

Nirsoft 9 IoCs

resource	yara_rule
behavioral2/memory/1060-124-0x000002D1F5690000-0x000002D1F59CB000-memory.dmp	Nirsoft
behavioral2/files/0x000500000001aba9-143.dat	Nirsoft
behavioral2/files/0x000500000001aba9-144.dat	Nirsoft
behavioral2/files/0x000400000001abaf-151.dat	Nirsoft
behavioral2/files/0x000400000001abaf-152.dat	Nirsoft
behavioral2/files/0x000400000001abac-165.dat	Nirsoft
behavioral2/files/0x000400000001abac-166.dat	Nirsoft
behavioral2/files/0x000400000001abae-174.dat	Nirsoft
behavioral2/files/0x000400000001abae-175.dat	Nirsoft

Executes dropped EXE 7 IoCs

pid	Process
1060	RtkBtManServ.exe
3000	bfsvc.exe
1720	snuvcdsm.exe
3052	winhlp32.exe
3256	splwow64.exe
1648	hh.exe
4088	xwizard.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000001abaa-159.dat	upx
behavioral2/files/0x000500000001abaa-160.dat	upx
behavioral2/files/0x000500000001abad-162.dat	upx
behavioral2/files/0x000500000001abad-163.dat	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings	RtkBtManServ.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1720	snuvcdsm.exe
1720	snuvcdsm.exe
1720	snuvcdsm.exe
1720	snuvcdsm.exe
1648	hh.exe
1648	hh.exe
4088	xwizard.exe
4088	xwizard.exe
4088	xwizard.exe
4088	xwizard.exe
4088	xwizard.exe
4088	xwizard.exe
4088	xwizard.exe
4088	xwizard.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	RtkBtManServ.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 1060	3724	Token Grabber V2.exe	69
PID 3724 wrote to memory of 1060	3724	Token Grabber V2.exe	69
PID 3724 wrote to memory of 816	3724	Token Grabber V2.exe	70
PID 3724 wrote to memory of 816	3724	Token Grabber V2.exe	70
PID 816 wrote to memory of 1996	816	cmd.exe	72
PID 816 wrote to memory of 1996	816	cmd.exe	72
PID 1060 wrote to memory of 3184	1060	RtkBtManServ.exe	73
PID 1060 wrote to memory of 3184	1060	RtkBtManServ.exe	73
PID 3184 wrote to memory of 1344	3184	WScript.exe	74
PID 3184 wrote to memory of 1344	3184	WScript.exe	74
PID 1344 wrote to memory of 3000	1344	cmd.exe	76
PID 1344 wrote to memory of 3000	1344	cmd.exe	76
PID 1344 wrote to memory of 3000	1344	cmd.exe	76
PID 1060 wrote to memory of 1028	1060	RtkBtManServ.exe	77
PID 1060 wrote to memory of 1028	1060	RtkBtManServ.exe	77
PID 1028 wrote to memory of 2424	1028	WScript.exe	78
PID 1028 wrote to memory of 2424	1028	WScript.exe	78
PID 2424 wrote to memory of 1720	2424	cmd.exe	80
PID 2424 wrote to memory of 1720	2424	cmd.exe	80
PID 2424 wrote to memory of 1720	2424	cmd.exe	80
PID 1060 wrote to memory of 1976	1060	RtkBtManServ.exe	81
PID 1060 wrote to memory of 1976	1060	RtkBtManServ.exe	81
PID 1976 wrote to memory of 3880	1976	WScript.exe	82
PID 1976 wrote to memory of 3880	1976	WScript.exe	82
PID 3880 wrote to memory of 3052	3880	cmd.exe	84
PID 3880 wrote to memory of 3052	3880	cmd.exe	84
PID 3880 wrote to memory of 3052	3880	cmd.exe	84
PID 3880 wrote to memory of 3256	3880	cmd.exe	86
PID 3880 wrote to memory of 3256	3880	cmd.exe	86
PID 3880 wrote to memory of 3256	3880	cmd.exe	86
PID 3880 wrote to memory of 1648	3880	cmd.exe	87
PID 3880 wrote to memory of 1648	3880	cmd.exe	87
PID 3880 wrote to memory of 1648	3880	cmd.exe	87
PID 1060 wrote to memory of 2508	1060	RtkBtManServ.exe	88
PID 1060 wrote to memory of 2508	1060	RtkBtManServ.exe	88
PID 2508 wrote to memory of 2500	2508	WScript.exe	89
PID 2508 wrote to memory of 2500	2508	WScript.exe	89
PID 2500 wrote to memory of 4088	2500	cmd.exe	91
PID 2500 wrote to memory of 4088	2500	cmd.exe	91
PID 2500 wrote to memory of 4088	2500	cmd.exe	91
PID 1060 wrote to memory of 4024	1060	RtkBtManServ.exe	92
PID 1060 wrote to memory of 4024	1060	RtkBtManServ.exe	92
PID 4024 wrote to memory of 8	4024	cmd.exe	94
PID 4024 wrote to memory of 8	4024	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\Token Grabber V2.exe
"C:\Users\Admin\AppData\Local\Temp\Token Grabber V2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
  "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs6EaD/IyziOY6Wp9tb11lmAwdPr3eaephPO6ZBHil7KBxxKQpOulqQI6zqdhvdoQ9yTRWw9wpKnG2TwwwMoT++juIbWuGK0y72cRMrFOY9FzlaanaWRc3Ed9Ys7/LRbpOE=
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
        
        C:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"
        5⤵
        Executes dropped EXE
        
        PID:3000
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1720
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
        
        C:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"
        5⤵
        Executes dropped EXE
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\splwow64.exe
        
        C:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"
        5⤵
        Executes dropped EXE
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\hh.exe
        
        C:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1648
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\xwizard.exe
        
        C:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4088
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:8
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Token Grabber V2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-134-0x000002D1F54D0000-0x000002D1F54FF000-memory.dmp

Download

memory/1060-127-0x000002D1F5680000-0x000002D1F5682000-memory.dmp

Download

memory/1060-131-0x000002D1DCB10000-0x000002D1DCB3A000-memory.dmp

Download

memory/1060-130-0x000002D1DCB60000-0x000002D1DCB61000-memory.dmp

Download

memory/1060-137-0x000002D1F5650000-0x000002D1F5651000-memory.dmp

Download

memory/1060-128-0x000002D1F5420000-0x000002D1F54CC000-memory.dmp

Download

memory/1060-132-0x000002D1DCB40000-0x000002D1DCB46000-memory.dmp

Download

memory/1060-125-0x000002D1DB2A0000-0x000002D1DB2A1000-memory.dmp

Download

memory/1060-133-0x000002D1F5610000-0x000002D1F5611000-memory.dmp

Download

memory/1060-124-0x000002D1F5690000-0x000002D1F59CB000-memory.dmp

Download

memory/1060-136-0x000002D1DCC30000-0x000002D1DCC31000-memory.dmp

Download

memory/1060-135-0x000002D1F6390000-0x000002D1F642B000-memory.dmp

Download

memory/1060-120-0x000002D1DAC70000-0x000002D1DAC71000-memory.dmp

Download

memory/1060-126-0x000002D1DCBB0000-0x000002D1DCBB1000-memory.dmp

Download

memory/3724-115-0x000001C7735B0000-0x000001C7735B1000-memory.dmp

Download