Analysis
-
max time kernel
60s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20/01/2023, 15:32
Behavioral task
behavioral1
Sample
battle_net.exe
Resource
win7-20220901-en
7 signatures
150 seconds
General
-
Target
battle_net.exe
-
Size
272.4MB
-
MD5
bf4959547d8735d468dd21e2b66d17a8
-
SHA1
df743097f6be2ab02bb1c3e162f29c70d6b1d1d8
-
SHA256
44b64cb2be0a5e9fd51528f00a308df71ead226c7cf733ed2568ada07c9044a8
-
SHA512
1c17f986fb04200e51cda150c4b7dd7da826568c84d6fd7a5b4f0861edee9c3f301c6417a4fd30950379d288ab39ee57428bfefcb231b534f9fd3b82acf93301
-
SSDEEP
49152:7VPS+54ybpRHV/jeNTpGktKDJ3MDvXIFRBMgUQyKQartOJU63D02F1yNw:7JS44ybfRjHFMgMJU/N
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1520 wmic.exe Token: SeSecurityPrivilege 1520 wmic.exe Token: SeTakeOwnershipPrivilege 1520 wmic.exe Token: SeLoadDriverPrivilege 1520 wmic.exe Token: SeSystemProfilePrivilege 1520 wmic.exe Token: SeSystemtimePrivilege 1520 wmic.exe Token: SeProfSingleProcessPrivilege 1520 wmic.exe Token: SeIncBasePriorityPrivilege 1520 wmic.exe Token: SeCreatePagefilePrivilege 1520 wmic.exe Token: SeBackupPrivilege 1520 wmic.exe Token: SeRestorePrivilege 1520 wmic.exe Token: SeShutdownPrivilege 1520 wmic.exe Token: SeDebugPrivilege 1520 wmic.exe Token: SeSystemEnvironmentPrivilege 1520 wmic.exe Token: SeRemoteShutdownPrivilege 1520 wmic.exe Token: SeUndockPrivilege 1520 wmic.exe Token: SeManageVolumePrivilege 1520 wmic.exe Token: 33 1520 wmic.exe Token: 34 1520 wmic.exe Token: 35 1520 wmic.exe Token: SeIncreaseQuotaPrivilege 1520 wmic.exe Token: SeSecurityPrivilege 1520 wmic.exe Token: SeTakeOwnershipPrivilege 1520 wmic.exe Token: SeLoadDriverPrivilege 1520 wmic.exe Token: SeSystemProfilePrivilege 1520 wmic.exe Token: SeSystemtimePrivilege 1520 wmic.exe Token: SeProfSingleProcessPrivilege 1520 wmic.exe Token: SeIncBasePriorityPrivilege 1520 wmic.exe Token: SeCreatePagefilePrivilege 1520 wmic.exe Token: SeBackupPrivilege 1520 wmic.exe Token: SeRestorePrivilege 1520 wmic.exe Token: SeShutdownPrivilege 1520 wmic.exe Token: SeDebugPrivilege 1520 wmic.exe Token: SeSystemEnvironmentPrivilege 1520 wmic.exe Token: SeRemoteShutdownPrivilege 1520 wmic.exe Token: SeUndockPrivilege 1520 wmic.exe Token: SeManageVolumePrivilege 1520 wmic.exe Token: 33 1520 wmic.exe Token: 34 1520 wmic.exe Token: 35 1520 wmic.exe Token: SeIncreaseQuotaPrivilege 1140 WMIC.exe Token: SeSecurityPrivilege 1140 WMIC.exe Token: SeTakeOwnershipPrivilege 1140 WMIC.exe Token: SeLoadDriverPrivilege 1140 WMIC.exe Token: SeSystemProfilePrivilege 1140 WMIC.exe Token: SeSystemtimePrivilege 1140 WMIC.exe Token: SeProfSingleProcessPrivilege 1140 WMIC.exe Token: SeIncBasePriorityPrivilege 1140 WMIC.exe Token: SeCreatePagefilePrivilege 1140 WMIC.exe Token: SeBackupPrivilege 1140 WMIC.exe Token: SeRestorePrivilege 1140 WMIC.exe Token: SeShutdownPrivilege 1140 WMIC.exe Token: SeDebugPrivilege 1140 WMIC.exe Token: SeSystemEnvironmentPrivilege 1140 WMIC.exe Token: SeRemoteShutdownPrivilege 1140 WMIC.exe Token: SeUndockPrivilege 1140 WMIC.exe Token: SeManageVolumePrivilege 1140 WMIC.exe Token: 33 1140 WMIC.exe Token: 34 1140 WMIC.exe Token: 35 1140 WMIC.exe Token: SeIncreaseQuotaPrivilege 1140 WMIC.exe Token: SeSecurityPrivilege 1140 WMIC.exe Token: SeTakeOwnershipPrivilege 1140 WMIC.exe Token: SeLoadDriverPrivilege 1140 WMIC.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe -
Suspicious use of SendNotifyMessage 25 IoCs
pid Process 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1520 1724 battle_net.exe 27 PID 1724 wrote to memory of 1520 1724 battle_net.exe 27 PID 1724 wrote to memory of 1520 1724 battle_net.exe 27 PID 1724 wrote to memory of 1520 1724 battle_net.exe 27 PID 1724 wrote to memory of 1860 1724 battle_net.exe 30 PID 1724 wrote to memory of 1860 1724 battle_net.exe 30 PID 1724 wrote to memory of 1860 1724 battle_net.exe 30 PID 1724 wrote to memory of 1860 1724 battle_net.exe 30 PID 1860 wrote to memory of 1140 1860 cmd.exe 32 PID 1860 wrote to memory of 1140 1860 cmd.exe 32 PID 1860 wrote to memory of 1140 1860 cmd.exe 32 PID 1860 wrote to memory of 1140 1860 cmd.exe 32 PID 1724 wrote to memory of 1344 1724 battle_net.exe 33 PID 1724 wrote to memory of 1344 1724 battle_net.exe 33 PID 1724 wrote to memory of 1344 1724 battle_net.exe 33 PID 1724 wrote to memory of 1344 1724 battle_net.exe 33 PID 1344 wrote to memory of 452 1344 cmd.exe 35 PID 1344 wrote to memory of 452 1344 cmd.exe 35 PID 1344 wrote to memory of 452 1344 cmd.exe 35 PID 1344 wrote to memory of 452 1344 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\battle_net.exe"C:\Users\Admin\AppData\Local\Temp\battle_net.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:452
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:836