Analysis
- max time kernel
91s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
24/01/2023, 17:19
Behavioral task
behavioral1
Sample
LibreOffice_7.4.4_Win_x64.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
General
- Target LibreOffice_7.4.4_Win_x64.exe
- Size 4.3MB
- Sample230124-vvs84scg86
- SHA256 515e7fa2e16b9723f02b9676aeeb392c3e246a3a76dd52de2779f164d7c0cb78
- MD5 e180d59d9dfa41f80e57e030f68dad4c
- SHA1 8e1c8feb0e9ca11250b7d0a7c98c825ea10d76c5
- SHA512 ebd204c02f5edcd6d84a37cd6918cafa5745dba05b14a409f87ee564c870248e746205cf41e1bc5ebbf97ef2fb2ef4f25b0d53bea05e1186f5a4c4ccc68e3b33
- SSDEEP 49152:mynSK5EsNuNc4Jyj+NTpGktKDJ3Me01iVZChKENKEhaStuJUSQW02F1fNFm:m9KmsNuNIjnyhK9JUYNM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 540 wmic.exe Token: SeSecurityPrivilege 540 wmic.exe Token: SeTakeOwnershipPrivilege 540 wmic.exe Token: SeLoadDriverPrivilege 540 wmic.exe Token: SeSystemProfilePrivilege 540 wmic.exe Token: SeSystemtimePrivilege 540 wmic.exe Token: SeProfSingleProcessPrivilege 540 wmic.exe Token: SeIncBasePriorityPrivilege 540 wmic.exe Token: SeCreatePagefilePrivilege 540 wmic.exe Token: SeBackupPrivilege 540 wmic.exe Token: SeRestorePrivilege 540 wmic.exe Token: SeShutdownPrivilege 540 wmic.exe Token: SeDebugPrivilege 540 wmic.exe Token: SeSystemEnvironmentPrivilege 540 wmic.exe Token: SeRemoteShutdownPrivilege 540 wmic.exe Token: SeUndockPrivilege 540 wmic.exe Token: SeManageVolumePrivilege 540 wmic.exe Token: 33 540 wmic.exe Token: 34 540 wmic.exe Token: 35 540 wmic.exe Token: 36 540 wmic.exe Token: SeIncreaseQuotaPrivilege 540 wmic.exe Token: SeSecurityPrivilege 540 wmic.exe Token: SeTakeOwnershipPrivilege 540 wmic.exe Token: SeLoadDriverPrivilege 540 wmic.exe Token: SeSystemProfilePrivilege 540 wmic.exe Token: SeSystemtimePrivilege 540 wmic.exe Token: SeProfSingleProcessPrivilege 540 wmic.exe Token: SeIncBasePriorityPrivilege 540 wmic.exe Token: SeCreatePagefilePrivilege 540 wmic.exe Token: SeBackupPrivilege 540 wmic.exe Token: SeRestorePrivilege 540 wmic.exe Token: SeShutdownPrivilege 540 wmic.exe Token: SeDebugPrivilege 540 wmic.exe Token: SeSystemEnvironmentPrivilege 540 wmic.exe Token: SeRemoteShutdownPrivilege 540 wmic.exe Token: SeUndockPrivilege 540 wmic.exe Token: SeManageVolumePrivilege 540 wmic.exe Token: 33 540 wmic.exe Token: 34 540 wmic.exe Token: 35 540 wmic.exe Token: 36 540 wmic.exe Token: SeIncreaseQuotaPrivilege 920 WMIC.exe Token: SeSecurityPrivilege 920 WMIC.exe Token: SeTakeOwnershipPrivilege 920 WMIC.exe Token: SeLoadDriverPrivilege 920 WMIC.exe Token: SeSystemProfilePrivilege 920 WMIC.exe Token: SeSystemtimePrivilege 920 WMIC.exe Token: SeProfSingleProcessPrivilege 920 WMIC.exe Token: SeIncBasePriorityPrivilege 920 WMIC.exe Token: SeCreatePagefilePrivilege 920 WMIC.exe Token: SeBackupPrivilege 920 WMIC.exe Token: SeRestorePrivilege 920 WMIC.exe Token: SeShutdownPrivilege 920 WMIC.exe Token: SeDebugPrivilege 920 WMIC.exe Token: SeSystemEnvironmentPrivilege 920 WMIC.exe Token: SeRemoteShutdownPrivilege 920 WMIC.exe Token: SeUndockPrivilege 920 WMIC.exe Token: SeManageVolumePrivilege 920 WMIC.exe Token: 33 920 WMIC.exe Token: 34 920 WMIC.exe Token: 35 920 WMIC.exe Token: 36 920 WMIC.exe Token: SeIncreaseQuotaPrivilege 920 WMIC.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1508 wrote to memory of 540 1508 LibreOffice_7.4.4_Win_x64.exe 81 PID 1508 wrote to memory of 540 1508 LibreOffice_7.4.4_Win_x64.exe 81 PID 1508 wrote to memory of 540 1508 LibreOffice_7.4.4_Win_x64.exe 81 PID 1508 wrote to memory of 4432 1508 LibreOffice_7.4.4_Win_x64.exe 83 PID 1508 wrote to memory of 4432 1508 LibreOffice_7.4.4_Win_x64.exe 83 PID 1508 wrote to memory of 4432 1508 LibreOffice_7.4.4_Win_x64.exe 83 PID 4432 wrote to memory of 920 4432 cmd.exe 85 PID 4432 wrote to memory of 920 4432 cmd.exe 85 PID 4432 wrote to memory of 920 4432 cmd.exe 85 PID 1508 wrote to memory of 796 1508 LibreOffice_7.4.4_Win_x64.exe 86 PID 1508 wrote to memory of 796 1508 LibreOffice_7.4.4_Win_x64.exe 86 PID 1508 wrote to memory of 796 1508 LibreOffice_7.4.4_Win_x64.exe 86 PID 796 wrote to memory of 2404 796 cmd.exe 88 PID 796 wrote to memory of 2404 796 cmd.exe 88 PID 796 wrote to memory of 2404 796 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\LibreOffice_7.4.4_Win_x64.exe"C:\Users\Admin\AppData\Local\Temp\LibreOffice_7.4.4_Win_x64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:2404
-
-