Analysis
- max time kernel
50s - max time network
178s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system - submitted
19/01/2023, 03:59
Behavioral task
behavioral1
Sample
4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
300 seconds
General
- Target 4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe
- Size 4.6MB
- Sample230119-ej9hysbf3s
- SHA256 4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1
- MD5 f145cfd352f02066d13e270357f26f58
- SHA1 83d781b47ed72c4c1ace3a784bf16356d3649cf5
- SHA512 e9ff3d4c80aea631d48cbc59cdbf2b0fc186a13a2a7aafacdad8d79c60b52b08445285ff769fbf92ce94a1df7904c05b2665f3dd39bc4b26ac3434779b62cbef
- SSDEEP 49152:5Jp9F00HU4YumjR73mRVnYTev3bQoRGJaI5EnvUtGH5RDHZ015bUy39Q:R00EuNVnYs4EaGZRD+bUy3S
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4060 wmic.exe Token: SeSecurityPrivilege 4060 wmic.exe Token: SeTakeOwnershipPrivilege 4060 wmic.exe Token: SeLoadDriverPrivilege 4060 wmic.exe Token: SeSystemProfilePrivilege 4060 wmic.exe Token: SeSystemtimePrivilege 4060 wmic.exe Token: SeProfSingleProcessPrivilege 4060 wmic.exe Token: SeIncBasePriorityPrivilege 4060 wmic.exe Token: SeCreatePagefilePrivilege 4060 wmic.exe Token: SeBackupPrivilege 4060 wmic.exe Token: SeRestorePrivilege 4060 wmic.exe Token: SeShutdownPrivilege 4060 wmic.exe Token: SeDebugPrivilege 4060 wmic.exe Token: SeSystemEnvironmentPrivilege 4060 wmic.exe Token: SeRemoteShutdownPrivilege 4060 wmic.exe Token: SeUndockPrivilege 4060 wmic.exe Token: SeManageVolumePrivilege 4060 wmic.exe Token: 33 4060 wmic.exe Token: 34 4060 wmic.exe Token: 35 4060 wmic.exe Token: 36 4060 wmic.exe Token: SeIncreaseQuotaPrivilege 4060 wmic.exe Token: SeSecurityPrivilege 4060 wmic.exe Token: SeTakeOwnershipPrivilege 4060 wmic.exe Token: SeLoadDriverPrivilege 4060 wmic.exe Token: SeSystemProfilePrivilege 4060 wmic.exe Token: SeSystemtimePrivilege 4060 wmic.exe Token: SeProfSingleProcessPrivilege 4060 wmic.exe Token: SeIncBasePriorityPrivilege 4060 wmic.exe Token: SeCreatePagefilePrivilege 4060 wmic.exe Token: SeBackupPrivilege 4060 wmic.exe Token: SeRestorePrivilege 4060 wmic.exe Token: SeShutdownPrivilege 4060 wmic.exe Token: SeDebugPrivilege 4060 wmic.exe Token: SeSystemEnvironmentPrivilege 4060 wmic.exe Token: SeRemoteShutdownPrivilege 4060 wmic.exe Token: SeUndockPrivilege 4060 wmic.exe Token: SeManageVolumePrivilege 4060 wmic.exe Token: 33 4060 wmic.exe Token: 34 4060 wmic.exe Token: 35 4060 wmic.exe Token: 36 4060 wmic.exe Token: SeIncreaseQuotaPrivilege 3836 WMIC.exe Token: SeSecurityPrivilege 3836 WMIC.exe Token: SeTakeOwnershipPrivilege 3836 WMIC.exe Token: SeLoadDriverPrivilege 3836 WMIC.exe Token: SeSystemProfilePrivilege 3836 WMIC.exe Token: SeSystemtimePrivilege 3836 WMIC.exe Token: SeProfSingleProcessPrivilege 3836 WMIC.exe Token: SeIncBasePriorityPrivilege 3836 WMIC.exe Token: SeCreatePagefilePrivilege 3836 WMIC.exe Token: SeBackupPrivilege 3836 WMIC.exe Token: SeRestorePrivilege 3836 WMIC.exe Token: SeShutdownPrivilege 3836 WMIC.exe Token: SeDebugPrivilege 3836 WMIC.exe Token: SeSystemEnvironmentPrivilege 3836 WMIC.exe Token: SeRemoteShutdownPrivilege 3836 WMIC.exe Token: SeUndockPrivilege 3836 WMIC.exe Token: SeManageVolumePrivilege 3836 WMIC.exe Token: 33 3836 WMIC.exe Token: 34 3836 WMIC.exe Token: 35 3836 WMIC.exe Token: 36 3836 WMIC.exe Token: SeIncreaseQuotaPrivilege 3836 WMIC.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5108 wrote to memory of 4060 5108 4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe 67 PID 5108 wrote to memory of 4060 5108 4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe 67 PID 5108 wrote to memory of 1880 5108 4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe 70 PID 5108 wrote to memory of 1880 5108 4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe 70 PID 1880 wrote to memory of 3836 1880 cmd.exe 72 PID 1880 wrote to memory of 3836 1880 cmd.exe 72 PID 5108 wrote to memory of 3736 5108 4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe 73 PID 5108 wrote to memory of 3736 5108 4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe 73 PID 3736 wrote to memory of 4008 3736 cmd.exe 75 PID 3736 wrote to memory of 4008 3736 cmd.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe"C:\Users\Admin\AppData\Local\Temp\4965ec3502ceae59f4feae76144743a7f6c96e6c66db8c295faab4a2f8f5b0d1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4008
-
-