Analysis
-
max time kernel
12s -
max time network
302s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 22:17
Static task
static1
Behavioral task
behavioral1
Sample
2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
300 seconds
General
-
Target
2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe
-
Size
4.4MB
-
MD5
867c71f074b9121542595bde9709c2b6
-
SHA1
faa029153fba48715e164d263b0df39dc5102ab6
-
SHA256
2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1
-
SHA512
1184c6bce6f9dbe4bbe0253e3a40d06fbb7d907f47dbbcb44bdb895b065985e4910f0e9e6dad2c4b832ab404c3f5f5271ccf47950c29a91bda1b5f67a24e2095
-
SSDEEP
49152:9ddj9ge0TmYUtHZ4jNPfiluylvkBEk060xav5EN5tGQnlrjGn01+:9CemoIPn9xEVG8lG
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1984 wmic.exe Token: SeSecurityPrivilege 1984 wmic.exe Token: SeTakeOwnershipPrivilege 1984 wmic.exe Token: SeLoadDriverPrivilege 1984 wmic.exe Token: SeSystemProfilePrivilege 1984 wmic.exe Token: SeSystemtimePrivilege 1984 wmic.exe Token: SeProfSingleProcessPrivilege 1984 wmic.exe Token: SeIncBasePriorityPrivilege 1984 wmic.exe Token: SeCreatePagefilePrivilege 1984 wmic.exe Token: SeBackupPrivilege 1984 wmic.exe Token: SeRestorePrivilege 1984 wmic.exe Token: SeShutdownPrivilege 1984 wmic.exe Token: SeDebugPrivilege 1984 wmic.exe Token: SeSystemEnvironmentPrivilege 1984 wmic.exe Token: SeRemoteShutdownPrivilege 1984 wmic.exe Token: SeUndockPrivilege 1984 wmic.exe Token: SeManageVolumePrivilege 1984 wmic.exe Token: 33 1984 wmic.exe Token: 34 1984 wmic.exe Token: 35 1984 wmic.exe Token: SeIncreaseQuotaPrivilege 1984 wmic.exe Token: SeSecurityPrivilege 1984 wmic.exe Token: SeTakeOwnershipPrivilege 1984 wmic.exe Token: SeLoadDriverPrivilege 1984 wmic.exe Token: SeSystemProfilePrivilege 1984 wmic.exe Token: SeSystemtimePrivilege 1984 wmic.exe Token: SeProfSingleProcessPrivilege 1984 wmic.exe Token: SeIncBasePriorityPrivilege 1984 wmic.exe Token: SeCreatePagefilePrivilege 1984 wmic.exe Token: SeBackupPrivilege 1984 wmic.exe Token: SeRestorePrivilege 1984 wmic.exe Token: SeShutdownPrivilege 1984 wmic.exe Token: SeDebugPrivilege 1984 wmic.exe Token: SeSystemEnvironmentPrivilege 1984 wmic.exe Token: SeRemoteShutdownPrivilege 1984 wmic.exe Token: SeUndockPrivilege 1984 wmic.exe Token: SeManageVolumePrivilege 1984 wmic.exe Token: 33 1984 wmic.exe Token: 34 1984 wmic.exe Token: 35 1984 wmic.exe Token: SeIncreaseQuotaPrivilege 820 WMIC.exe Token: SeSecurityPrivilege 820 WMIC.exe Token: SeTakeOwnershipPrivilege 820 WMIC.exe Token: SeLoadDriverPrivilege 820 WMIC.exe Token: SeSystemProfilePrivilege 820 WMIC.exe Token: SeSystemtimePrivilege 820 WMIC.exe Token: SeProfSingleProcessPrivilege 820 WMIC.exe Token: SeIncBasePriorityPrivilege 820 WMIC.exe Token: SeCreatePagefilePrivilege 820 WMIC.exe Token: SeBackupPrivilege 820 WMIC.exe Token: SeRestorePrivilege 820 WMIC.exe Token: SeShutdownPrivilege 820 WMIC.exe Token: SeDebugPrivilege 820 WMIC.exe Token: SeSystemEnvironmentPrivilege 820 WMIC.exe Token: SeRemoteShutdownPrivilege 820 WMIC.exe Token: SeUndockPrivilege 820 WMIC.exe Token: SeManageVolumePrivilege 820 WMIC.exe Token: 33 820 WMIC.exe Token: 34 820 WMIC.exe Token: 35 820 WMIC.exe Token: SeIncreaseQuotaPrivilege 820 WMIC.exe Token: SeSecurityPrivilege 820 WMIC.exe Token: SeTakeOwnershipPrivilege 820 WMIC.exe Token: SeLoadDriverPrivilege 820 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1608 wrote to memory of 1984 1608 2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe 26 PID 1608 wrote to memory of 1984 1608 2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe 26 PID 1608 wrote to memory of 1984 1608 2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe 26 PID 1608 wrote to memory of 616 1608 2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe 29 PID 1608 wrote to memory of 616 1608 2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe 29 PID 1608 wrote to memory of 616 1608 2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe 29 PID 616 wrote to memory of 820 616 cmd.exe 31 PID 616 wrote to memory of 820 616 cmd.exe 31 PID 616 wrote to memory of 820 616 cmd.exe 31 PID 1608 wrote to memory of 904 1608 2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe 32 PID 1608 wrote to memory of 904 1608 2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe 32 PID 1608 wrote to memory of 904 1608 2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe 32 PID 904 wrote to memory of 1756 904 cmd.exe 34 PID 904 wrote to memory of 1756 904 cmd.exe 34 PID 904 wrote to memory of 1756 904 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe"C:\Users\Admin\AppData\Local\Temp\2ed1ed1a7fcc1aa7ad61369cedc39718cd1e93748b88d989cbeaa9c98b7f87b1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:820
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1756
-
-