Analysis
-
max time kernel
90s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 15:18
Static task
static1
General
-
Target
2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe
-
Size
5.6MB
-
MD5
80dea74a9e8fbb4a4f2b6681ba662269
-
SHA1
06de9468ee0b84a289bb326b9e291eda67a6920e
-
SHA256
2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199
-
SHA512
f5f04c65d1647319d492750dd1501a198d3839892d503ab8d19daca33513a198afde3aa9a222fc5c7021d11a6f8e30a56424d20852eccdec5b18b42491198b0b
-
SSDEEP
49152:RIEXLFe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgi1ao:RIEmSjL+EnHOMz5ysZA5+bf6c
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4468 wmic.exe Token: SeSecurityPrivilege 4468 wmic.exe Token: SeTakeOwnershipPrivilege 4468 wmic.exe Token: SeLoadDriverPrivilege 4468 wmic.exe Token: SeSystemProfilePrivilege 4468 wmic.exe Token: SeSystemtimePrivilege 4468 wmic.exe Token: SeProfSingleProcessPrivilege 4468 wmic.exe Token: SeIncBasePriorityPrivilege 4468 wmic.exe Token: SeCreatePagefilePrivilege 4468 wmic.exe Token: SeBackupPrivilege 4468 wmic.exe Token: SeRestorePrivilege 4468 wmic.exe Token: SeShutdownPrivilege 4468 wmic.exe Token: SeDebugPrivilege 4468 wmic.exe Token: SeSystemEnvironmentPrivilege 4468 wmic.exe Token: SeRemoteShutdownPrivilege 4468 wmic.exe Token: SeUndockPrivilege 4468 wmic.exe Token: SeManageVolumePrivilege 4468 wmic.exe Token: 33 4468 wmic.exe Token: 34 4468 wmic.exe Token: 35 4468 wmic.exe Token: 36 4468 wmic.exe Token: SeIncreaseQuotaPrivilege 4468 wmic.exe Token: SeSecurityPrivilege 4468 wmic.exe Token: SeTakeOwnershipPrivilege 4468 wmic.exe Token: SeLoadDriverPrivilege 4468 wmic.exe Token: SeSystemProfilePrivilege 4468 wmic.exe Token: SeSystemtimePrivilege 4468 wmic.exe Token: SeProfSingleProcessPrivilege 4468 wmic.exe Token: SeIncBasePriorityPrivilege 4468 wmic.exe Token: SeCreatePagefilePrivilege 4468 wmic.exe Token: SeBackupPrivilege 4468 wmic.exe Token: SeRestorePrivilege 4468 wmic.exe Token: SeShutdownPrivilege 4468 wmic.exe Token: SeDebugPrivilege 4468 wmic.exe Token: SeSystemEnvironmentPrivilege 4468 wmic.exe Token: SeRemoteShutdownPrivilege 4468 wmic.exe Token: SeUndockPrivilege 4468 wmic.exe Token: SeManageVolumePrivilege 4468 wmic.exe Token: 33 4468 wmic.exe Token: 34 4468 wmic.exe Token: 35 4468 wmic.exe Token: 36 4468 wmic.exe Token: SeIncreaseQuotaPrivilege 3212 WMIC.exe Token: SeSecurityPrivilege 3212 WMIC.exe Token: SeTakeOwnershipPrivilege 3212 WMIC.exe Token: SeLoadDriverPrivilege 3212 WMIC.exe Token: SeSystemProfilePrivilege 3212 WMIC.exe Token: SeSystemtimePrivilege 3212 WMIC.exe Token: SeProfSingleProcessPrivilege 3212 WMIC.exe Token: SeIncBasePriorityPrivilege 3212 WMIC.exe Token: SeCreatePagefilePrivilege 3212 WMIC.exe Token: SeBackupPrivilege 3212 WMIC.exe Token: SeRestorePrivilege 3212 WMIC.exe Token: SeShutdownPrivilege 3212 WMIC.exe Token: SeDebugPrivilege 3212 WMIC.exe Token: SeSystemEnvironmentPrivilege 3212 WMIC.exe Token: SeRemoteShutdownPrivilege 3212 WMIC.exe Token: SeUndockPrivilege 3212 WMIC.exe Token: SeManageVolumePrivilege 3212 WMIC.exe Token: 33 3212 WMIC.exe Token: 34 3212 WMIC.exe Token: 35 3212 WMIC.exe Token: 36 3212 WMIC.exe Token: SeIncreaseQuotaPrivilege 3212 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1936 wrote to memory of 4468 1936 2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe 89 PID 1936 wrote to memory of 4468 1936 2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe 89 PID 1936 wrote to memory of 4468 1936 2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe 89 PID 1936 wrote to memory of 4728 1936 2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe 91 PID 1936 wrote to memory of 4728 1936 2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe 91 PID 1936 wrote to memory of 4728 1936 2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe 91 PID 4728 wrote to memory of 3212 4728 cmd.exe 93 PID 4728 wrote to memory of 3212 4728 cmd.exe 93 PID 4728 wrote to memory of 3212 4728 cmd.exe 93 PID 1936 wrote to memory of 616 1936 2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe 94 PID 1936 wrote to memory of 616 1936 2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe 94 PID 1936 wrote to memory of 616 1936 2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe 94 PID 616 wrote to memory of 544 616 cmd.exe 96 PID 616 wrote to memory of 544 616 cmd.exe 96 PID 616 wrote to memory of 544 616 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe"C:\Users\Admin\AppData\Local\Temp\2fab3518fdcc817c501a089c7ab4e191e1e69c5dfaf8bab6430f897d7fbe3199.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:544
-
-