Analysis
-
max time kernel
112s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 19:41
Static task
static1
General
-
Target
accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe
-
Size
5.6MB
-
MD5
baee2cafa658388caee10524e2f0b122
-
SHA1
4f2f91a0c4e69dd1ca69e1596a3e3aea5dff34c6
-
SHA256
accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999
-
SHA512
28b5b0e1c9be9ca20e65c6fa8180482c723589894d110ea737ee51e5fef8789fd44b1fdd6d359a9fed51a6d590ea5f87e1736fd27f7902e64504ffa42f634f6d
-
SSDEEP
49152:RIEXRFe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgi1ao:RIE0SjL+EnHOMz5ysZA5+bf6c
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 812 wmic.exe Token: SeSecurityPrivilege 812 wmic.exe Token: SeTakeOwnershipPrivilege 812 wmic.exe Token: SeLoadDriverPrivilege 812 wmic.exe Token: SeSystemProfilePrivilege 812 wmic.exe Token: SeSystemtimePrivilege 812 wmic.exe Token: SeProfSingleProcessPrivilege 812 wmic.exe Token: SeIncBasePriorityPrivilege 812 wmic.exe Token: SeCreatePagefilePrivilege 812 wmic.exe Token: SeBackupPrivilege 812 wmic.exe Token: SeRestorePrivilege 812 wmic.exe Token: SeShutdownPrivilege 812 wmic.exe Token: SeDebugPrivilege 812 wmic.exe Token: SeSystemEnvironmentPrivilege 812 wmic.exe Token: SeRemoteShutdownPrivilege 812 wmic.exe Token: SeUndockPrivilege 812 wmic.exe Token: SeManageVolumePrivilege 812 wmic.exe Token: 33 812 wmic.exe Token: 34 812 wmic.exe Token: 35 812 wmic.exe Token: 36 812 wmic.exe Token: SeIncreaseQuotaPrivilege 812 wmic.exe Token: SeSecurityPrivilege 812 wmic.exe Token: SeTakeOwnershipPrivilege 812 wmic.exe Token: SeLoadDriverPrivilege 812 wmic.exe Token: SeSystemProfilePrivilege 812 wmic.exe Token: SeSystemtimePrivilege 812 wmic.exe Token: SeProfSingleProcessPrivilege 812 wmic.exe Token: SeIncBasePriorityPrivilege 812 wmic.exe Token: SeCreatePagefilePrivilege 812 wmic.exe Token: SeBackupPrivilege 812 wmic.exe Token: SeRestorePrivilege 812 wmic.exe Token: SeShutdownPrivilege 812 wmic.exe Token: SeDebugPrivilege 812 wmic.exe Token: SeSystemEnvironmentPrivilege 812 wmic.exe Token: SeRemoteShutdownPrivilege 812 wmic.exe Token: SeUndockPrivilege 812 wmic.exe Token: SeManageVolumePrivilege 812 wmic.exe Token: 33 812 wmic.exe Token: 34 812 wmic.exe Token: 35 812 wmic.exe Token: 36 812 wmic.exe Token: SeIncreaseQuotaPrivilege 4004 WMIC.exe Token: SeSecurityPrivilege 4004 WMIC.exe Token: SeTakeOwnershipPrivilege 4004 WMIC.exe Token: SeLoadDriverPrivilege 4004 WMIC.exe Token: SeSystemProfilePrivilege 4004 WMIC.exe Token: SeSystemtimePrivilege 4004 WMIC.exe Token: SeProfSingleProcessPrivilege 4004 WMIC.exe Token: SeIncBasePriorityPrivilege 4004 WMIC.exe Token: SeCreatePagefilePrivilege 4004 WMIC.exe Token: SeBackupPrivilege 4004 WMIC.exe Token: SeRestorePrivilege 4004 WMIC.exe Token: SeShutdownPrivilege 4004 WMIC.exe Token: SeDebugPrivilege 4004 WMIC.exe Token: SeSystemEnvironmentPrivilege 4004 WMIC.exe Token: SeRemoteShutdownPrivilege 4004 WMIC.exe Token: SeUndockPrivilege 4004 WMIC.exe Token: SeManageVolumePrivilege 4004 WMIC.exe Token: 33 4004 WMIC.exe Token: 34 4004 WMIC.exe Token: 35 4004 WMIC.exe Token: 36 4004 WMIC.exe Token: SeIncreaseQuotaPrivilege 4004 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4940 wrote to memory of 812 4940 accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe 90 PID 4940 wrote to memory of 812 4940 accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe 90 PID 4940 wrote to memory of 812 4940 accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe 90 PID 4940 wrote to memory of 2396 4940 accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe 92 PID 4940 wrote to memory of 2396 4940 accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe 92 PID 4940 wrote to memory of 2396 4940 accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe 92 PID 2396 wrote to memory of 4004 2396 cmd.exe 94 PID 2396 wrote to memory of 4004 2396 cmd.exe 94 PID 2396 wrote to memory of 4004 2396 cmd.exe 94 PID 4940 wrote to memory of 4728 4940 accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe 95 PID 4940 wrote to memory of 4728 4940 accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe 95 PID 4940 wrote to memory of 4728 4940 accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe 95 PID 4728 wrote to memory of 4408 4728 cmd.exe 97 PID 4728 wrote to memory of 4408 4728 cmd.exe 97 PID 4728 wrote to memory of 4408 4728 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe"C:\Users\Admin\AppData\Local\Temp\accf04fbd10810a42d7dbc28943915f4509b3999e56584887215178cdcdd9999.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:812
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:4408
-
-