Analysis
- max time kernel
88s - max time network
132s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
17/11/2021, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
32bbf022c7e0f74d9f7ec4d61b21e87e.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
- Target 32bbf022c7e0f74d9f7ec4d61b21e87e.exe
- Size 1.4MB
- Sample211117-rlpmsachc9
- SHA256 18fc04f68981f482ac56ba91ff7346b4730c0e0b9954cb7d3b9cbbb04d6b61bf
- MD5 32bbf022c7e0f74d9f7ec4d61b21e87e
- SHA1 e9771ad3fdf7217d4c40a95ac1210dfe64390659
- SHA512 76adcf833a07132527e48f81a259320db56c978bcb30f01825e475cb3027fce07d874abaa586d32a00efe1af38952247bff4e77269625581bea0b7c1377b2cda
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
pid Process 1324 taskkill.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeAssignPrimaryTokenPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeLockMemoryPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeIncreaseQuotaPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeMachineAccountPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeTcbPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeSecurityPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeTakeOwnershipPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeLoadDriverPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeSystemProfilePrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeSystemtimePrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeProfSingleProcessPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeIncBasePriorityPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeCreatePagefilePrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeCreatePermanentPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeBackupPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeRestorePrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeShutdownPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeDebugPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeAuditPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeSystemEnvironmentPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeChangeNotifyPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeRemoteShutdownPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeUndockPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeSyncAgentPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeEnableDelegationPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeManageVolumePrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeImpersonatePrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeCreateGlobalPrivilege 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: 31 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: 32 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: 33 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: 34 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: 35 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe Token: SeDebugPrivilege 1324 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2708 wrote to memory of 1152 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe 69 PID 2708 wrote to memory of 1152 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe 69 PID 2708 wrote to memory of 1152 2708 32bbf022c7e0f74d9f7ec4d61b21e87e.exe 69 PID 1152 wrote to memory of 1324 1152 cmd.exe 71 PID 1152 wrote to memory of 1324 1152 cmd.exe 71 PID 1152 wrote to memory of 1324 1152 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\32bbf022c7e0f74d9f7ec4d61b21e87e.exe"C:\Users\Admin\AppData\Local\Temp\32bbf022c7e0f74d9f7ec4d61b21e87e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-