Analysis
-
max time kernel
104s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2022 10:09
Static task
static1
General
-
Target
c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe
-
Size
5.6MB
-
MD5
e7ac48a05970c6f13bb9bde037c17c86
-
SHA1
847054d1123823681dfce3817ccab3c9d3f25b0f
-
SHA256
c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8
-
SHA512
0842860f8e8e2a72a9d45278d715b34e11de280bda3605701676b8683dd83324cb59673f661039e3b3a697ac6c76bb35991c3ae8e59be274e12c8a10ef17432a
-
SSDEEP
49152:RIEXfFe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgi1ao:RIESSjL+EnHOMz5ysZA5+bf6c
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3336 wmic.exe Token: SeSecurityPrivilege 3336 wmic.exe Token: SeTakeOwnershipPrivilege 3336 wmic.exe Token: SeLoadDriverPrivilege 3336 wmic.exe Token: SeSystemProfilePrivilege 3336 wmic.exe Token: SeSystemtimePrivilege 3336 wmic.exe Token: SeProfSingleProcessPrivilege 3336 wmic.exe Token: SeIncBasePriorityPrivilege 3336 wmic.exe Token: SeCreatePagefilePrivilege 3336 wmic.exe Token: SeBackupPrivilege 3336 wmic.exe Token: SeRestorePrivilege 3336 wmic.exe Token: SeShutdownPrivilege 3336 wmic.exe Token: SeDebugPrivilege 3336 wmic.exe Token: SeSystemEnvironmentPrivilege 3336 wmic.exe Token: SeRemoteShutdownPrivilege 3336 wmic.exe Token: SeUndockPrivilege 3336 wmic.exe Token: SeManageVolumePrivilege 3336 wmic.exe Token: 33 3336 wmic.exe Token: 34 3336 wmic.exe Token: 35 3336 wmic.exe Token: 36 3336 wmic.exe Token: SeIncreaseQuotaPrivilege 3336 wmic.exe Token: SeSecurityPrivilege 3336 wmic.exe Token: SeTakeOwnershipPrivilege 3336 wmic.exe Token: SeLoadDriverPrivilege 3336 wmic.exe Token: SeSystemProfilePrivilege 3336 wmic.exe Token: SeSystemtimePrivilege 3336 wmic.exe Token: SeProfSingleProcessPrivilege 3336 wmic.exe Token: SeIncBasePriorityPrivilege 3336 wmic.exe Token: SeCreatePagefilePrivilege 3336 wmic.exe Token: SeBackupPrivilege 3336 wmic.exe Token: SeRestorePrivilege 3336 wmic.exe Token: SeShutdownPrivilege 3336 wmic.exe Token: SeDebugPrivilege 3336 wmic.exe Token: SeSystemEnvironmentPrivilege 3336 wmic.exe Token: SeRemoteShutdownPrivilege 3336 wmic.exe Token: SeUndockPrivilege 3336 wmic.exe Token: SeManageVolumePrivilege 3336 wmic.exe Token: 33 3336 wmic.exe Token: 34 3336 wmic.exe Token: 35 3336 wmic.exe Token: 36 3336 wmic.exe Token: SeIncreaseQuotaPrivilege 1812 WMIC.exe Token: SeSecurityPrivilege 1812 WMIC.exe Token: SeTakeOwnershipPrivilege 1812 WMIC.exe Token: SeLoadDriverPrivilege 1812 WMIC.exe Token: SeSystemProfilePrivilege 1812 WMIC.exe Token: SeSystemtimePrivilege 1812 WMIC.exe Token: SeProfSingleProcessPrivilege 1812 WMIC.exe Token: SeIncBasePriorityPrivilege 1812 WMIC.exe Token: SeCreatePagefilePrivilege 1812 WMIC.exe Token: SeBackupPrivilege 1812 WMIC.exe Token: SeRestorePrivilege 1812 WMIC.exe Token: SeShutdownPrivilege 1812 WMIC.exe Token: SeDebugPrivilege 1812 WMIC.exe Token: SeSystemEnvironmentPrivilege 1812 WMIC.exe Token: SeRemoteShutdownPrivilege 1812 WMIC.exe Token: SeUndockPrivilege 1812 WMIC.exe Token: SeManageVolumePrivilege 1812 WMIC.exe Token: 33 1812 WMIC.exe Token: 34 1812 WMIC.exe Token: 35 1812 WMIC.exe Token: 36 1812 WMIC.exe Token: SeIncreaseQuotaPrivilege 1812 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4912 wrote to memory of 3336 4912 c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe 90 PID 4912 wrote to memory of 3336 4912 c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe 90 PID 4912 wrote to memory of 3336 4912 c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe 90 PID 4912 wrote to memory of 3144 4912 c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe 92 PID 4912 wrote to memory of 3144 4912 c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe 92 PID 4912 wrote to memory of 3144 4912 c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe 92 PID 3144 wrote to memory of 1812 3144 cmd.exe 94 PID 3144 wrote to memory of 1812 3144 cmd.exe 94 PID 3144 wrote to memory of 1812 3144 cmd.exe 94 PID 4912 wrote to memory of 2804 4912 c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe 95 PID 4912 wrote to memory of 2804 4912 c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe 95 PID 4912 wrote to memory of 2804 4912 c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe 95 PID 2804 wrote to memory of 2308 2804 cmd.exe 97 PID 2804 wrote to memory of 2308 2804 cmd.exe 97 PID 2804 wrote to memory of 2308 2804 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe"C:\Users\Admin\AppData\Local\Temp\c92fcc6ec50482f0e35330801dd1a743e4d7a211f81512efcd8038eb5889c6b8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:2308
-
-