Analysis
- max time kernel
137s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
16/01/2023, 15:27
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Langs/Hungarian.ps1
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Langs/Hungarian.ps1
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Langs/Korean.ps1
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Langs/Korean.ps1
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target AnyDesk.exe
- Size 764.5MB
- Sample230116-svrn6sdb2v
- SHA256 70496410c46bb3134a14de73c6cf908e69191a943908fc127d0bf288c81dfee7
- MD5 94650f322b81af879bd2a29614dbebc7
- SHA1 2478201c44a92d0695632a8ba16aa7ed18afeaf0
- SHA512 466a63872e519794e5060dd7b8726365b9c3862488e00452db212f5683dd282c57e55bb7bfa5a804aa23c6460fce61140ef642cc12d7df2a9b1941461b7cc010
- SSDEEP 49152:HBj9ybH3dYuRgGWUgu1P472tqHlZ11tCSa45E0DStGH5RDHW01:mbHLR3472tO9EhGZRD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3692 wmic.exe Token: SeSecurityPrivilege 3692 wmic.exe Token: SeTakeOwnershipPrivilege 3692 wmic.exe Token: SeLoadDriverPrivilege 3692 wmic.exe Token: SeSystemProfilePrivilege 3692 wmic.exe Token: SeSystemtimePrivilege 3692 wmic.exe Token: SeProfSingleProcessPrivilege 3692 wmic.exe Token: SeIncBasePriorityPrivilege 3692 wmic.exe Token: SeCreatePagefilePrivilege 3692 wmic.exe Token: SeBackupPrivilege 3692 wmic.exe Token: SeRestorePrivilege 3692 wmic.exe Token: SeShutdownPrivilege 3692 wmic.exe Token: SeDebugPrivilege 3692 wmic.exe Token: SeSystemEnvironmentPrivilege 3692 wmic.exe Token: SeRemoteShutdownPrivilege 3692 wmic.exe Token: SeUndockPrivilege 3692 wmic.exe Token: SeManageVolumePrivilege 3692 wmic.exe Token: 33 3692 wmic.exe Token: 34 3692 wmic.exe Token: 35 3692 wmic.exe Token: 36 3692 wmic.exe Token: SeIncreaseQuotaPrivilege 3692 wmic.exe Token: SeSecurityPrivilege 3692 wmic.exe Token: SeTakeOwnershipPrivilege 3692 wmic.exe Token: SeLoadDriverPrivilege 3692 wmic.exe Token: SeSystemProfilePrivilege 3692 wmic.exe Token: SeSystemtimePrivilege 3692 wmic.exe Token: SeProfSingleProcessPrivilege 3692 wmic.exe Token: SeIncBasePriorityPrivilege 3692 wmic.exe Token: SeCreatePagefilePrivilege 3692 wmic.exe Token: SeBackupPrivilege 3692 wmic.exe Token: SeRestorePrivilege 3692 wmic.exe Token: SeShutdownPrivilege 3692 wmic.exe Token: SeDebugPrivilege 3692 wmic.exe Token: SeSystemEnvironmentPrivilege 3692 wmic.exe Token: SeRemoteShutdownPrivilege 3692 wmic.exe Token: SeUndockPrivilege 3692 wmic.exe Token: SeManageVolumePrivilege 3692 wmic.exe Token: 33 3692 wmic.exe Token: 34 3692 wmic.exe Token: 35 3692 wmic.exe Token: 36 3692 wmic.exe Token: SeIncreaseQuotaPrivilege 224 WMIC.exe Token: SeSecurityPrivilege 224 WMIC.exe Token: SeTakeOwnershipPrivilege 224 WMIC.exe Token: SeLoadDriverPrivilege 224 WMIC.exe Token: SeSystemProfilePrivilege 224 WMIC.exe Token: SeSystemtimePrivilege 224 WMIC.exe Token: SeProfSingleProcessPrivilege 224 WMIC.exe Token: SeIncBasePriorityPrivilege 224 WMIC.exe Token: SeCreatePagefilePrivilege 224 WMIC.exe Token: SeBackupPrivilege 224 WMIC.exe Token: SeRestorePrivilege 224 WMIC.exe Token: SeShutdownPrivilege 224 WMIC.exe Token: SeDebugPrivilege 224 WMIC.exe Token: SeSystemEnvironmentPrivilege 224 WMIC.exe Token: SeRemoteShutdownPrivilege 224 WMIC.exe Token: SeUndockPrivilege 224 WMIC.exe Token: SeManageVolumePrivilege 224 WMIC.exe Token: 33 224 WMIC.exe Token: 34 224 WMIC.exe Token: 35 224 WMIC.exe Token: 36 224 WMIC.exe Token: SeIncreaseQuotaPrivilege 224 WMIC.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2260 wrote to memory of 3692 2260 AnyDesk.exe 81 PID 2260 wrote to memory of 3692 2260 AnyDesk.exe 81 PID 2260 wrote to memory of 4836 2260 AnyDesk.exe 83 PID 2260 wrote to memory of 4836 2260 AnyDesk.exe 83 PID 4836 wrote to memory of 224 4836 cmd.exe 85 PID 4836 wrote to memory of 224 4836 cmd.exe 85 PID 2260 wrote to memory of 3920 2260 AnyDesk.exe 86 PID 2260 wrote to memory of 3920 2260 AnyDesk.exe 86 PID 3920 wrote to memory of 4668 3920 cmd.exe 88 PID 3920 wrote to memory of 4668 3920 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3692
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:224
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4668
-
-