Analysis

  • max time kernel
    152s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2022 00:29

General

  • Target

    ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50.exe

  • Size

    120KB

  • MD5

    9e2d5116462c18c2a8b0dcb7bd88e9ca

  • SHA1

    74ca2e701aae44413e3706a37ff44ebbe6c0e19d

  • SHA256

    ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50

  • SHA512

    43da95509dfebfc6908e0fdd27c22c1e4e806b814103cb1c53386e0e4da222c4b918a7050c5eb2941a9110042de0d0f2de95a6086b64b22aebef4ce796344ee3

  • SSDEEP

    1536:WlnMg9bWAdy4nHfUHD28+we3cotuFDcF4DfQKRx50KVT4iKEFXvxKqHs:WlNsAdy4n/UKw4co9FMfQeN/Xey

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50.exe
    "C:\Users\Admin\AppData\Local\Temp\ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\ProgramData\Application Data\inetinfo.exe
      "C:\ProgramData\Application Data\inetinfo.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\info.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:588
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo
          4⤵
          • Gathers system information
          PID:1212
        • C:\Windows\SysWOW64\net.exe
          net user
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:996
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user
            5⤵
              PID:1832
          • C:\Windows\SysWOW64\net.exe
            net localgroup administrators
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2032
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 localgroup administrators
              5⤵
                PID:944
            • C:\Windows\SysWOW64\net.exe
              net start
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1916
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start
                5⤵
                  PID:1060
              • C:\Windows\SysWOW64\net.exe
                net view
                4⤵
                • Discovers systems in the same network
                PID:1972
              • C:\Windows\SysWOW64\net.exe
                net view /domain
                4⤵
                • Discovers systems in the same network
                PID:752
              • C:\Windows\SysWOW64\net.exe
                net user /domain
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1100
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 user /domain
                  5⤵
                    PID:552
                • C:\Windows\SysWOW64\NETSTAT.EXE
                  netstat -ano
                  4⤵
                  • Gathers network information
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1064
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  4⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:804
                • C:\Windows\SysWOW64\ipconfig.exe
                  ipconfig /all
                  4⤵
                  • Gathers network information
                  PID:1996
                • C:\Windows\SysWOW64\ARP.EXE
                  arp -a
                  4⤵
                    PID:896

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\inetinfo.exe

              Filesize

              120KB

              MD5

              9e2d5116462c18c2a8b0dcb7bd88e9ca

              SHA1

              74ca2e701aae44413e3706a37ff44ebbe6c0e19d

              SHA256

              ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50

              SHA512

              43da95509dfebfc6908e0fdd27c22c1e4e806b814103cb1c53386e0e4da222c4b918a7050c5eb2941a9110042de0d0f2de95a6086b64b22aebef4ce796344ee3

            • C:\Users\Admin\AppData\Local\Temp\info.bat

              Filesize

              581B

              MD5

              52b5878fbe8ecfafe96177c8001328b7

              SHA1

              3bc5f0fe87c76ed056e940dfcfaa176397527d94

              SHA256

              2ce2bccf6b09a3b49aafe4306b378fe0f4dea8f1104c1a0dfc060af5945f37db

              SHA512

              d6284b5b081887a2773cd4d459c225d9952b4f28551ea98f2463ef70009443bc75138fb6e5a871a14ab7935102e57b3cbc8310cafc1d97f530ed9a8ac6c4dd5c

            • \ProgramData\inetinfo.exe

              Filesize

              120KB

              MD5

              9e2d5116462c18c2a8b0dcb7bd88e9ca

              SHA1

              74ca2e701aae44413e3706a37ff44ebbe6c0e19d

              SHA256

              ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50

              SHA512

              43da95509dfebfc6908e0fdd27c22c1e4e806b814103cb1c53386e0e4da222c4b918a7050c5eb2941a9110042de0d0f2de95a6086b64b22aebef4ce796344ee3

            • \ProgramData\inetinfo.exe

              Filesize

              120KB

              MD5

              9e2d5116462c18c2a8b0dcb7bd88e9ca

              SHA1

              74ca2e701aae44413e3706a37ff44ebbe6c0e19d

              SHA256

              ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50

              SHA512

              43da95509dfebfc6908e0fdd27c22c1e4e806b814103cb1c53386e0e4da222c4b918a7050c5eb2941a9110042de0d0f2de95a6086b64b22aebef4ce796344ee3

            • memory/552-75-0x0000000000000000-mapping.dmp

            • memory/588-63-0x0000000000000000-mapping.dmp

            • memory/752-73-0x0000000000000000-mapping.dmp

            • memory/804-77-0x0000000000000000-mapping.dmp

            • memory/896-80-0x0000000000000000-mapping.dmp

            • memory/944-69-0x0000000000000000-mapping.dmp

            • memory/996-66-0x0000000000000000-mapping.dmp

            • memory/1060-71-0x0000000000000000-mapping.dmp

            • memory/1064-76-0x0000000000000000-mapping.dmp

            • memory/1100-74-0x0000000000000000-mapping.dmp

            • memory/1108-62-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1108-58-0x0000000000000000-mapping.dmp

            • memory/1108-81-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1148-61-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1148-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

              Filesize

              8KB

            • memory/1148-55-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1212-65-0x0000000000000000-mapping.dmp

            • memory/1832-67-0x0000000000000000-mapping.dmp

            • memory/1916-70-0x0000000000000000-mapping.dmp

            • memory/1972-72-0x0000000000000000-mapping.dmp

            • memory/1996-78-0x0000000000000000-mapping.dmp

            • memory/2032-68-0x0000000000000000-mapping.dmp