Analysis
- max time kernel
120s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
01/01/2022, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
b5bd36fa3b85bd04ce7b4205363d0ffe.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target b5bd36fa3b85bd04ce7b4205363d0ffe.exe
- Size 1.4MB
- Sample220101-j415jagabq
- SHA256 dc99510c2660ee64b95820e61184f27d7dda8391f44804c6fe0d045bd106ae56
- MD5 b5bd36fa3b85bd04ce7b4205363d0ffe
- SHA1 604dfdc91044e7ec222b065d87f192d6ad73091f
- SHA512 da19047bb2eb44fc8dfc5e2a1a1a44d4eb3334d2a674a77d6df65ccd72d777a5ed0c07e446b5dc0c24ae1c194ca3e56477ea2422b09b38762bc1d40bda872151
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
pid Process 4076 taskkill.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeAssignPrimaryTokenPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeLockMemoryPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeIncreaseQuotaPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeMachineAccountPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeTcbPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeSecurityPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeTakeOwnershipPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeLoadDriverPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeSystemProfilePrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeSystemtimePrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeProfSingleProcessPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeIncBasePriorityPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeCreatePagefilePrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeCreatePermanentPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeBackupPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeRestorePrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeShutdownPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeDebugPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeAuditPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeSystemEnvironmentPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeChangeNotifyPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeRemoteShutdownPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeUndockPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeSyncAgentPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeEnableDelegationPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeManageVolumePrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeImpersonatePrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeCreateGlobalPrivilege 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: 31 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: 32 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: 33 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: 34 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: 35 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe Token: SeDebugPrivilege 4076 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3672 wrote to memory of 780 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe 69 PID 3672 wrote to memory of 780 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe 69 PID 3672 wrote to memory of 780 3672 b5bd36fa3b85bd04ce7b4205363d0ffe.exe 69 PID 780 wrote to memory of 4076 780 cmd.exe 71 PID 780 wrote to memory of 4076 780 cmd.exe 71 PID 780 wrote to memory of 4076 780 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5bd36fa3b85bd04ce7b4205363d0ffe.exe"C:\Users\Admin\AppData\Local\Temp\b5bd36fa3b85bd04ce7b4205363d0ffe.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-