Analysis
- max time kernel
111s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
19/01/2023, 19:43
Behavioral task
behavioral1
Sample
extracted.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
General
- Target extracted.exe
- Size 4.5MB
- Sample230119-ye8weahb68
- SHA256 7c5f6eb2a7eafa8c6891486bb1af755cc64e087c67945ab51bada4f4fcaea2ed
- MD5 13ab6631db796ac189d7f29e1a86e1f7
- SHA1 342b9765c1df3c6ec832199f91eb2ffe808a416e
- SHA512 a718bf555b293716f2c82011db68b3aa7d8a93ee746b5e2795393c8bd478e459b175570302a97cf3238a0248899c23e8553579c41317741a39e4431a9909a5b3
- SSDEEP 49152:HBj9ybH3dYuRgGWUgu1P472tqHlZ11tCwa45E0DwtGH5RDHW01:mbHLR3472tOrELGZRD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4868 wmic.exe Token: SeSecurityPrivilege 4868 wmic.exe Token: SeTakeOwnershipPrivilege 4868 wmic.exe Token: SeLoadDriverPrivilege 4868 wmic.exe Token: SeSystemProfilePrivilege 4868 wmic.exe Token: SeSystemtimePrivilege 4868 wmic.exe Token: SeProfSingleProcessPrivilege 4868 wmic.exe Token: SeIncBasePriorityPrivilege 4868 wmic.exe Token: SeCreatePagefilePrivilege 4868 wmic.exe Token: SeBackupPrivilege 4868 wmic.exe Token: SeRestorePrivilege 4868 wmic.exe Token: SeShutdownPrivilege 4868 wmic.exe Token: SeDebugPrivilege 4868 wmic.exe Token: SeSystemEnvironmentPrivilege 4868 wmic.exe Token: SeRemoteShutdownPrivilege 4868 wmic.exe Token: SeUndockPrivilege 4868 wmic.exe Token: SeManageVolumePrivilege 4868 wmic.exe Token: 33 4868 wmic.exe Token: 34 4868 wmic.exe Token: 35 4868 wmic.exe Token: 36 4868 wmic.exe Token: SeIncreaseQuotaPrivilege 4868 wmic.exe Token: SeSecurityPrivilege 4868 wmic.exe Token: SeTakeOwnershipPrivilege 4868 wmic.exe Token: SeLoadDriverPrivilege 4868 wmic.exe Token: SeSystemProfilePrivilege 4868 wmic.exe Token: SeSystemtimePrivilege 4868 wmic.exe Token: SeProfSingleProcessPrivilege 4868 wmic.exe Token: SeIncBasePriorityPrivilege 4868 wmic.exe Token: SeCreatePagefilePrivilege 4868 wmic.exe Token: SeBackupPrivilege 4868 wmic.exe Token: SeRestorePrivilege 4868 wmic.exe Token: SeShutdownPrivilege 4868 wmic.exe Token: SeDebugPrivilege 4868 wmic.exe Token: SeSystemEnvironmentPrivilege 4868 wmic.exe Token: SeRemoteShutdownPrivilege 4868 wmic.exe Token: SeUndockPrivilege 4868 wmic.exe Token: SeManageVolumePrivilege 4868 wmic.exe Token: 33 4868 wmic.exe Token: 34 4868 wmic.exe Token: 35 4868 wmic.exe Token: 36 4868 wmic.exe Token: SeIncreaseQuotaPrivilege 4040 WMIC.exe Token: SeSecurityPrivilege 4040 WMIC.exe Token: SeTakeOwnershipPrivilege 4040 WMIC.exe Token: SeLoadDriverPrivilege 4040 WMIC.exe Token: SeSystemProfilePrivilege 4040 WMIC.exe Token: SeSystemtimePrivilege 4040 WMIC.exe Token: SeProfSingleProcessPrivilege 4040 WMIC.exe Token: SeIncBasePriorityPrivilege 4040 WMIC.exe Token: SeCreatePagefilePrivilege 4040 WMIC.exe Token: SeBackupPrivilege 4040 WMIC.exe Token: SeRestorePrivilege 4040 WMIC.exe Token: SeShutdownPrivilege 4040 WMIC.exe Token: SeDebugPrivilege 4040 WMIC.exe Token: SeSystemEnvironmentPrivilege 4040 WMIC.exe Token: SeRemoteShutdownPrivilege 4040 WMIC.exe Token: SeUndockPrivilege 4040 WMIC.exe Token: SeManageVolumePrivilege 4040 WMIC.exe Token: 33 4040 WMIC.exe Token: 34 4040 WMIC.exe Token: 35 4040 WMIC.exe Token: 36 4040 WMIC.exe Token: SeIncreaseQuotaPrivilege 4040 WMIC.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4324 wrote to memory of 4868 4324 extracted.exe 80 PID 4324 wrote to memory of 4868 4324 extracted.exe 80 PID 4324 wrote to memory of 4632 4324 extracted.exe 82 PID 4324 wrote to memory of 4632 4324 extracted.exe 82 PID 4632 wrote to memory of 4040 4632 cmd.exe 84 PID 4632 wrote to memory of 4040 4632 cmd.exe 84 PID 4324 wrote to memory of 5072 4324 extracted.exe 85 PID 4324 wrote to memory of 5072 4324 extracted.exe 85 PID 5072 wrote to memory of 3552 5072 cmd.exe 87 PID 5072 wrote to memory of 3552 5072 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\extracted.exe"C:\Users\Admin\AppData\Local\Temp\extracted.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3552
-
-