Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21/11/2021, 15:55
Static task
static1
Behavioral task
behavioral1
Sample
6ed15ba1793b318e075928be2009a1f1.exe
Resource
win7-en-20211104
0 signatures
0 seconds
General
-
Target
6ed15ba1793b318e075928be2009a1f1.exe
-
Size
1.7MB
-
MD5
6ed15ba1793b318e075928be2009a1f1
-
SHA1
01b2bf94f9e3c971cc20d73940c46f0854fd5412
-
SHA256
96da16f1b813f61ded62562735c22429b4a38ab5f42281afe16ae87e92abbf1b
-
SHA512
9158780264be1549c53b344a79a34f6dcc233b651078c4e9133b663c9965fbe6ca143fc6c9ccabb12703596d4fd89e314cf9db4d69b0997f3dff0b165a1abd90
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 552 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeAssignPrimaryTokenPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeLockMemoryPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeIncreaseQuotaPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeMachineAccountPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeTcbPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSecurityPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeTakeOwnershipPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeLoadDriverPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSystemProfilePrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSystemtimePrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeProfSingleProcessPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeIncBasePriorityPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeCreatePagefilePrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeCreatePermanentPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeBackupPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeRestorePrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeShutdownPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeDebugPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeAuditPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSystemEnvironmentPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeChangeNotifyPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeRemoteShutdownPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeUndockPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSyncAgentPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeEnableDelegationPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeManageVolumePrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeImpersonatePrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeCreateGlobalPrivilege 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: 31 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: 32 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: 33 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: 34 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: 35 2732 6ed15ba1793b318e075928be2009a1f1.exe Token: SeDebugPrivilege 552 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2256 2732 6ed15ba1793b318e075928be2009a1f1.exe 69 PID 2732 wrote to memory of 2256 2732 6ed15ba1793b318e075928be2009a1f1.exe 69 PID 2732 wrote to memory of 2256 2732 6ed15ba1793b318e075928be2009a1f1.exe 69 PID 2256 wrote to memory of 552 2256 cmd.exe 71 PID 2256 wrote to memory of 552 2256 cmd.exe 71 PID 2256 wrote to memory of 552 2256 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ed15ba1793b318e075928be2009a1f1.exe"C:\Users\Admin\AppData\Local\Temp\6ed15ba1793b318e075928be2009a1f1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-