07df13bc321083e74a3512b9861332e566c8d2ff201a3a5c8fcd2fd9fc8bfef6

Analysis

max time kernel
76s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2022 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DevSt.exe
Size

2.9MB
MD5

97824a1a018a194220866d5548eeff95
SHA1

35538496cf8c2761fc44f2d5f58882cda4d78400
SHA256

07df13bc321083e74a3512b9861332e566c8d2ff201a3a5c8fcd2fd9fc8bfef6
SHA512

754576ae3794dda1d9a86f87369f5cb3a4f951fbbb9e81560a8cd056e603c81a8b9ae644802a5a81d6e263608fdbd371fb9056cf8b6ea1e7e1e42b4c02e13aed
SSDEEP

49152:WW32/5/uXfOGcCwXwJeAqyKWJBafsL6M8Aoek1t:UsXW3wJrq2Ld8Ai

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4228	wmic.exe
Token: SeSecurityPrivilege	4228	wmic.exe
Token: SeTakeOwnershipPrivilege	4228	wmic.exe
Token: SeLoadDriverPrivilege	4228	wmic.exe
Token: SeSystemProfilePrivilege	4228	wmic.exe
Token: SeSystemtimePrivilege	4228	wmic.exe
Token: SeProfSingleProcessPrivilege	4228	wmic.exe
Token: SeIncBasePriorityPrivilege	4228	wmic.exe
Token: SeCreatePagefilePrivilege	4228	wmic.exe
Token: SeBackupPrivilege	4228	wmic.exe
Token: SeRestorePrivilege	4228	wmic.exe
Token: SeShutdownPrivilege	4228	wmic.exe
Token: SeDebugPrivilege	4228	wmic.exe
Token: SeSystemEnvironmentPrivilege	4228	wmic.exe
Token: SeRemoteShutdownPrivilege	4228	wmic.exe
Token: SeUndockPrivilege	4228	wmic.exe
Token: SeManageVolumePrivilege	4228	wmic.exe
Token: 33	4228	wmic.exe
Token: 34	4228	wmic.exe
Token: 35	4228	wmic.exe
Token: 36	4228	wmic.exe
Token: SeIncreaseQuotaPrivilege	4228	wmic.exe
Token: SeSecurityPrivilege	4228	wmic.exe
Token: SeTakeOwnershipPrivilege	4228	wmic.exe
Token: SeLoadDriverPrivilege	4228	wmic.exe
Token: SeSystemProfilePrivilege	4228	wmic.exe
Token: SeSystemtimePrivilege	4228	wmic.exe
Token: SeProfSingleProcessPrivilege	4228	wmic.exe
Token: SeIncBasePriorityPrivilege	4228	wmic.exe
Token: SeCreatePagefilePrivilege	4228	wmic.exe
Token: SeBackupPrivilege	4228	wmic.exe
Token: SeRestorePrivilege	4228	wmic.exe
Token: SeShutdownPrivilege	4228	wmic.exe
Token: SeDebugPrivilege	4228	wmic.exe
Token: SeSystemEnvironmentPrivilege	4228	wmic.exe
Token: SeRemoteShutdownPrivilege	4228	wmic.exe
Token: SeUndockPrivilege	4228	wmic.exe
Token: SeManageVolumePrivilege	4228	wmic.exe
Token: 33	4228	wmic.exe
Token: 34	4228	wmic.exe
Token: 35	4228	wmic.exe
Token: 36	4228	wmic.exe
Token: SeIncreaseQuotaPrivilege	2444	WMIC.exe
Token: SeSecurityPrivilege	2444	WMIC.exe
Token: SeTakeOwnershipPrivilege	2444	WMIC.exe
Token: SeLoadDriverPrivilege	2444	WMIC.exe
Token: SeSystemProfilePrivilege	2444	WMIC.exe
Token: SeSystemtimePrivilege	2444	WMIC.exe
Token: SeProfSingleProcessPrivilege	2444	WMIC.exe
Token: SeIncBasePriorityPrivilege	2444	WMIC.exe
Token: SeCreatePagefilePrivilege	2444	WMIC.exe
Token: SeBackupPrivilege	2444	WMIC.exe
Token: SeRestorePrivilege	2444	WMIC.exe
Token: SeShutdownPrivilege	2444	WMIC.exe
Token: SeDebugPrivilege	2444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2444	WMIC.exe
Token: SeRemoteShutdownPrivilege	2444	WMIC.exe
Token: SeUndockPrivilege	2444	WMIC.exe
Token: SeManageVolumePrivilege	2444	WMIC.exe
Token: 33	2444	WMIC.exe
Token: 34	2444	WMIC.exe
Token: 35	2444	WMIC.exe
Token: 36	2444	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2444	WMIC.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

DevSt.execmd.execmd.exe

description	pid	process	target process
PID 1140 wrote to memory of 4228	1140	DevSt.exe	wmic.exe
PID 1140 wrote to memory of 4228	1140	DevSt.exe	wmic.exe
PID 1140 wrote to memory of 3644	1140	DevSt.exe	cmd.exe
PID 1140 wrote to memory of 3644	1140	DevSt.exe	cmd.exe
PID 3644 wrote to memory of 2444	3644	cmd.exe	WMIC.exe
PID 3644 wrote to memory of 2444	3644	cmd.exe	WMIC.exe
PID 1140 wrote to memory of 1888	1140	DevSt.exe	cmd.exe
PID 1140 wrote to memory of 1888	1140	DevSt.exe	cmd.exe
PID 1888 wrote to memory of 4400	1888	cmd.exe	WMIC.exe
PID 1888 wrote to memory of 4400	1888	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\DevSt.exe
"C:\Users\Admin\AppData\Local\Temp\DevSt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\System32\Wbem\wmic.exe
wmic os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\cmd.exe
cmd /C "wmic cpu get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
3⤵
PID:4400

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-135-0x0000000000000000-mapping.dmp

Download
memory/2444-134-0x0000000000000000-mapping.dmp

Download
memory/3644-133-0x0000000000000000-mapping.dmp

Download
memory/4228-132-0x0000000000000000-mapping.dmp

Download
memory/4400-136-0x0000000000000000-mapping.dmp

Download