Analysis
- max time kernel
122s - max time network
128s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
13/12/2021, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
bf10f3a708a69cf386f75ee48e2c0d41.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target bf10f3a708a69cf386f75ee48e2c0d41.exe
- Size 1.4MB
- Sample211213-sdvz9sehbj
- SHA256 3e1c337647cbfe0c68d5d848334bd52bc362a14e108385f1eea03e79adba0f70
- MD5 bf10f3a708a69cf386f75ee48e2c0d41
- SHA1 8f46bf12723677524d47a17f614e5d858bf3e5e0
- SHA512 823ca82b7504971e25fa259f0968b7f95a230a9452c5f9778b646b03c2683d26157defbd07b9d1d19ed8fd0e91b12fb55ff7a0f21afc92e240ee0f638825974b
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
pid Process 860 taskkill.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeAssignPrimaryTokenPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeLockMemoryPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeIncreaseQuotaPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeMachineAccountPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeTcbPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeSecurityPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeTakeOwnershipPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeLoadDriverPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeSystemProfilePrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeSystemtimePrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeProfSingleProcessPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeIncBasePriorityPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeCreatePagefilePrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeCreatePermanentPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeBackupPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeRestorePrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeShutdownPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeDebugPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeAuditPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeSystemEnvironmentPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeChangeNotifyPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeRemoteShutdownPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeUndockPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeSyncAgentPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeEnableDelegationPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeManageVolumePrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeImpersonatePrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeCreateGlobalPrivilege 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: 31 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: 32 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: 33 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: 34 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: 35 428 bf10f3a708a69cf386f75ee48e2c0d41.exe Token: SeDebugPrivilege 860 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 428 wrote to memory of 2388 428 bf10f3a708a69cf386f75ee48e2c0d41.exe 69 PID 428 wrote to memory of 2388 428 bf10f3a708a69cf386f75ee48e2c0d41.exe 69 PID 428 wrote to memory of 2388 428 bf10f3a708a69cf386f75ee48e2c0d41.exe 69 PID 2388 wrote to memory of 860 2388 cmd.exe 71 PID 2388 wrote to memory of 860 2388 cmd.exe 71 PID 2388 wrote to memory of 860 2388 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf10f3a708a69cf386f75ee48e2c0d41.exe"C:\Users\Admin\AppData\Local\Temp\bf10f3a708a69cf386f75ee48e2c0d41.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-