Analysis
- max time kernel
64s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
24/10/2022, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
- Target file.exe
- Size 4.6MB
- Sample221024-rnewcshbe5
- SHA256 398df90a42c7b3cc43ea5095630ef3d8cf059beeda54e6a5888c839f5d6f5055
- MD5 734fcb6992cc87731801713d81f0d557
- SHA1 bf9a42ff5ec69d7945ddee72dd0ffc0315e2ff39
- SHA512 3b5883f8fd9e3030726b0d8f7884d270b74ea1e99b0c07ecf6fc17164ef2c339c3e38a793ae9e384936eed65363f1b64f6d14f4a1a5c0bfee7f3e2359cdf48b2
- SSDEEP 98304:ezAv5Q+EAG8l6EW3gWVup6aaIb7b7YEKtayr4dZ1YnvkMK83LhJokenV6Iq2K7z4:eE0u1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1396 wmic.exe Token: SeSecurityPrivilege 1396 wmic.exe Token: SeTakeOwnershipPrivilege 1396 wmic.exe Token: SeLoadDriverPrivilege 1396 wmic.exe Token: SeSystemProfilePrivilege 1396 wmic.exe Token: SeSystemtimePrivilege 1396 wmic.exe Token: SeProfSingleProcessPrivilege 1396 wmic.exe Token: SeIncBasePriorityPrivilege 1396 wmic.exe Token: SeCreatePagefilePrivilege 1396 wmic.exe Token: SeBackupPrivilege 1396 wmic.exe Token: SeRestorePrivilege 1396 wmic.exe Token: SeShutdownPrivilege 1396 wmic.exe Token: SeDebugPrivilege 1396 wmic.exe Token: SeSystemEnvironmentPrivilege 1396 wmic.exe Token: SeRemoteShutdownPrivilege 1396 wmic.exe Token: SeUndockPrivilege 1396 wmic.exe Token: SeManageVolumePrivilege 1396 wmic.exe Token: 33 1396 wmic.exe Token: 34 1396 wmic.exe Token: 35 1396 wmic.exe Token: 36 1396 wmic.exe Token: SeIncreaseQuotaPrivilege 1396 wmic.exe Token: SeSecurityPrivilege 1396 wmic.exe Token: SeTakeOwnershipPrivilege 1396 wmic.exe Token: SeLoadDriverPrivilege 1396 wmic.exe Token: SeSystemProfilePrivilege 1396 wmic.exe Token: SeSystemtimePrivilege 1396 wmic.exe Token: SeProfSingleProcessPrivilege 1396 wmic.exe Token: SeIncBasePriorityPrivilege 1396 wmic.exe Token: SeCreatePagefilePrivilege 1396 wmic.exe Token: SeBackupPrivilege 1396 wmic.exe Token: SeRestorePrivilege 1396 wmic.exe Token: SeShutdownPrivilege 1396 wmic.exe Token: SeDebugPrivilege 1396 wmic.exe Token: SeSystemEnvironmentPrivilege 1396 wmic.exe Token: SeRemoteShutdownPrivilege 1396 wmic.exe Token: SeUndockPrivilege 1396 wmic.exe Token: SeManageVolumePrivilege 1396 wmic.exe Token: 33 1396 wmic.exe Token: 34 1396 wmic.exe Token: 35 1396 wmic.exe Token: 36 1396 wmic.exe Token: SeIncreaseQuotaPrivilege 4896 WMIC.exe Token: SeSecurityPrivilege 4896 WMIC.exe Token: SeTakeOwnershipPrivilege 4896 WMIC.exe Token: SeLoadDriverPrivilege 4896 WMIC.exe Token: SeSystemProfilePrivilege 4896 WMIC.exe Token: SeSystemtimePrivilege 4896 WMIC.exe Token: SeProfSingleProcessPrivilege 4896 WMIC.exe Token: SeIncBasePriorityPrivilege 4896 WMIC.exe Token: SeCreatePagefilePrivilege 4896 WMIC.exe Token: SeBackupPrivilege 4896 WMIC.exe Token: SeRestorePrivilege 4896 WMIC.exe Token: SeShutdownPrivilege 4896 WMIC.exe Token: SeDebugPrivilege 4896 WMIC.exe Token: SeSystemEnvironmentPrivilege 4896 WMIC.exe Token: SeRemoteShutdownPrivilege 4896 WMIC.exe Token: SeUndockPrivilege 4896 WMIC.exe Token: SeManageVolumePrivilege 4896 WMIC.exe Token: 33 4896 WMIC.exe Token: 34 4896 WMIC.exe Token: 35 4896 WMIC.exe Token: 36 4896 WMIC.exe Token: SeIncreaseQuotaPrivilege 4896 WMIC.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4384 wrote to memory of 1396 4384 file.exe 83 PID 4384 wrote to memory of 1396 4384 file.exe 83 PID 4384 wrote to memory of 4868 4384 file.exe 85 PID 4384 wrote to memory of 4868 4384 file.exe 85 PID 4868 wrote to memory of 4896 4868 cmd.exe 87 PID 4868 wrote to memory of 4896 4868 cmd.exe 87 PID 4384 wrote to memory of 3208 4384 file.exe 88 PID 4384 wrote to memory of 3208 4384 file.exe 88 PID 3208 wrote to memory of 1304 3208 cmd.exe 90 PID 3208 wrote to memory of 1304 3208 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1304
-
-