Analysis
- max time kernel
154s - max time network
157s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
17/12/2021, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
e49dd2c1543e2548c419dbdf462e9242.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target e49dd2c1543e2548c419dbdf462e9242.exe
- Size 1.5MB
- Sample211217-matedaebhr
- SHA256 9256803a391489bbc1c5d71f032385fc85d9826f145c5bb90407ff8c541ebf40
- MD5 e49dd2c1543e2548c419dbdf462e9242
- SHA1 593b6fdede7440648d432018f82dd1afdee43d9a
- SHA512 bdfc2859308d24d395337f2a712d4363d6c62f871ba7f62114408d42107beeadd7bc43585dbbf18b8b876b3e0c49ebb031cb6db944c25cc4e61386dac69a3ceb
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
pid Process 1140 taskkill.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeAssignPrimaryTokenPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeLockMemoryPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeIncreaseQuotaPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeMachineAccountPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeTcbPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeSecurityPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeTakeOwnershipPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeLoadDriverPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeSystemProfilePrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeSystemtimePrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeProfSingleProcessPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeIncBasePriorityPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeCreatePagefilePrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeCreatePermanentPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeBackupPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeRestorePrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeShutdownPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeDebugPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeAuditPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeSystemEnvironmentPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeChangeNotifyPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeRemoteShutdownPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeUndockPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeSyncAgentPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeEnableDelegationPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeManageVolumePrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeImpersonatePrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeCreateGlobalPrivilege 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: 31 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: 32 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: 33 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: 34 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: 35 3716 e49dd2c1543e2548c419dbdf462e9242.exe Token: SeDebugPrivilege 1140 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3716 wrote to memory of 520 3716 e49dd2c1543e2548c419dbdf462e9242.exe 68 PID 3716 wrote to memory of 520 3716 e49dd2c1543e2548c419dbdf462e9242.exe 68 PID 3716 wrote to memory of 520 3716 e49dd2c1543e2548c419dbdf462e9242.exe 68 PID 520 wrote to memory of 1140 520 cmd.exe 70 PID 520 wrote to memory of 1140 520 cmd.exe 70 PID 520 wrote to memory of 1140 520 cmd.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\e49dd2c1543e2548c419dbdf462e9242.exe"C:\Users\Admin\AppData\Local\Temp\e49dd2c1543e2548c419dbdf462e9242.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-