Analysis
-
max time kernel
38s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17/10/2022, 02:27
Static task
static1
Behavioral task
behavioral1
Sample
e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
-
Target
e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe
-
Size
5.8MB
-
MD5
86039bb089c75cf42a34c303c1d2b2a9
-
SHA1
da6dbbbf1a16ebb4ee0373894a6f7706caf576d4
-
SHA256
e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46
-
SHA512
d0d39f4c51be5531ff74c4255ca8832c8637b604c6bac8e76ea72f66b8f8a642cbdb46c8761a9b11f5f77b0aa7925307bda672bc3c4d5b956c92f0f802617cc8
-
SSDEEP
49152:qnV9xa5Fe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgiR:qnV9xTSjL+EnHOMz5ysZA5+bf6c
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1616 wmic.exe Token: SeSecurityPrivilege 1616 wmic.exe Token: SeTakeOwnershipPrivilege 1616 wmic.exe Token: SeLoadDriverPrivilege 1616 wmic.exe Token: SeSystemProfilePrivilege 1616 wmic.exe Token: SeSystemtimePrivilege 1616 wmic.exe Token: SeProfSingleProcessPrivilege 1616 wmic.exe Token: SeIncBasePriorityPrivilege 1616 wmic.exe Token: SeCreatePagefilePrivilege 1616 wmic.exe Token: SeBackupPrivilege 1616 wmic.exe Token: SeRestorePrivilege 1616 wmic.exe Token: SeShutdownPrivilege 1616 wmic.exe Token: SeDebugPrivilege 1616 wmic.exe Token: SeSystemEnvironmentPrivilege 1616 wmic.exe Token: SeRemoteShutdownPrivilege 1616 wmic.exe Token: SeUndockPrivilege 1616 wmic.exe Token: SeManageVolumePrivilege 1616 wmic.exe Token: 33 1616 wmic.exe Token: 34 1616 wmic.exe Token: 35 1616 wmic.exe Token: SeIncreaseQuotaPrivilege 1616 wmic.exe Token: SeSecurityPrivilege 1616 wmic.exe Token: SeTakeOwnershipPrivilege 1616 wmic.exe Token: SeLoadDriverPrivilege 1616 wmic.exe Token: SeSystemProfilePrivilege 1616 wmic.exe Token: SeSystemtimePrivilege 1616 wmic.exe Token: SeProfSingleProcessPrivilege 1616 wmic.exe Token: SeIncBasePriorityPrivilege 1616 wmic.exe Token: SeCreatePagefilePrivilege 1616 wmic.exe Token: SeBackupPrivilege 1616 wmic.exe Token: SeRestorePrivilege 1616 wmic.exe Token: SeShutdownPrivilege 1616 wmic.exe Token: SeDebugPrivilege 1616 wmic.exe Token: SeSystemEnvironmentPrivilege 1616 wmic.exe Token: SeRemoteShutdownPrivilege 1616 wmic.exe Token: SeUndockPrivilege 1616 wmic.exe Token: SeManageVolumePrivilege 1616 wmic.exe Token: 33 1616 wmic.exe Token: 34 1616 wmic.exe Token: 35 1616 wmic.exe Token: SeIncreaseQuotaPrivilege 692 WMIC.exe Token: SeSecurityPrivilege 692 WMIC.exe Token: SeTakeOwnershipPrivilege 692 WMIC.exe Token: SeLoadDriverPrivilege 692 WMIC.exe Token: SeSystemProfilePrivilege 692 WMIC.exe Token: SeSystemtimePrivilege 692 WMIC.exe Token: SeProfSingleProcessPrivilege 692 WMIC.exe Token: SeIncBasePriorityPrivilege 692 WMIC.exe Token: SeCreatePagefilePrivilege 692 WMIC.exe Token: SeBackupPrivilege 692 WMIC.exe Token: SeRestorePrivilege 692 WMIC.exe Token: SeShutdownPrivilege 692 WMIC.exe Token: SeDebugPrivilege 692 WMIC.exe Token: SeSystemEnvironmentPrivilege 692 WMIC.exe Token: SeRemoteShutdownPrivilege 692 WMIC.exe Token: SeUndockPrivilege 692 WMIC.exe Token: SeManageVolumePrivilege 692 WMIC.exe Token: 33 692 WMIC.exe Token: 34 692 WMIC.exe Token: 35 692 WMIC.exe Token: SeIncreaseQuotaPrivilege 692 WMIC.exe Token: SeSecurityPrivilege 692 WMIC.exe Token: SeTakeOwnershipPrivilege 692 WMIC.exe Token: SeLoadDriverPrivilege 692 WMIC.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1616 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 26 PID 1712 wrote to memory of 1616 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 26 PID 1712 wrote to memory of 1616 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 26 PID 1712 wrote to memory of 1616 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 26 PID 1712 wrote to memory of 1992 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 29 PID 1712 wrote to memory of 1992 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 29 PID 1712 wrote to memory of 1992 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 29 PID 1712 wrote to memory of 1992 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 29 PID 1992 wrote to memory of 692 1992 cmd.exe 31 PID 1992 wrote to memory of 692 1992 cmd.exe 31 PID 1992 wrote to memory of 692 1992 cmd.exe 31 PID 1992 wrote to memory of 692 1992 cmd.exe 31 PID 1712 wrote to memory of 1496 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 32 PID 1712 wrote to memory of 1496 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 32 PID 1712 wrote to memory of 1496 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 32 PID 1712 wrote to memory of 1496 1712 e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe 32 PID 1496 wrote to memory of 1636 1496 cmd.exe 34 PID 1496 wrote to memory of 1636 1496 cmd.exe 34 PID 1496 wrote to memory of 1636 1496 cmd.exe 34 PID 1496 wrote to memory of 1636 1496 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe"C:\Users\Admin\AppData\Local\Temp\e7374a3329cfd52164b21c09ec8926f69940a25bac3dea9a1b4809e70e266b46.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:692
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:1636
-
-