Analysis
- max time kernel
91s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
03/02/2023, 01:05
Behavioral task
behavioral1
Sample
setup_win64.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
General
- Target setup_win64.exe
- Size 266.3MB
- Sample230203-bfl2pscg6s
- SHA256 533b139ebf5fb76c32d5fb6afbe8149edc70848dd2829ac68a2fa298eb25ee3d
- MD5 f12c985abb55c3b4c8fa92039a75ed04
- SHA1 1f9629cc64de3877ab938e66e4c23fbc0ba9ca1c
- SHA512 72d7f22c8f612e05bc7b520122ae20b83af22de2bb7c54b9cba6cf67efb8fb963e4370eaeca4db61ab45e6f09ce53ef4c8b9fe6370cafee47e7b311b0986379c
- SSDEEP 49152:I+uaJxyQHBhEx8mjUNTpGktKDJ3MkDL2I/TfsP/XQauzhJU7bn02F1PNd:IGJkQHB0xjjj/TdJUvN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4716 wmic.exe Token: SeSecurityPrivilege 4716 wmic.exe Token: SeTakeOwnershipPrivilege 4716 wmic.exe Token: SeLoadDriverPrivilege 4716 wmic.exe Token: SeSystemProfilePrivilege 4716 wmic.exe Token: SeSystemtimePrivilege 4716 wmic.exe Token: SeProfSingleProcessPrivilege 4716 wmic.exe Token: SeIncBasePriorityPrivilege 4716 wmic.exe Token: SeCreatePagefilePrivilege 4716 wmic.exe Token: SeBackupPrivilege 4716 wmic.exe Token: SeRestorePrivilege 4716 wmic.exe Token: SeShutdownPrivilege 4716 wmic.exe Token: SeDebugPrivilege 4716 wmic.exe Token: SeSystemEnvironmentPrivilege 4716 wmic.exe Token: SeRemoteShutdownPrivilege 4716 wmic.exe Token: SeUndockPrivilege 4716 wmic.exe Token: SeManageVolumePrivilege 4716 wmic.exe Token: 33 4716 wmic.exe Token: 34 4716 wmic.exe Token: 35 4716 wmic.exe Token: 36 4716 wmic.exe Token: SeIncreaseQuotaPrivilege 4716 wmic.exe Token: SeSecurityPrivilege 4716 wmic.exe Token: SeTakeOwnershipPrivilege 4716 wmic.exe Token: SeLoadDriverPrivilege 4716 wmic.exe Token: SeSystemProfilePrivilege 4716 wmic.exe Token: SeSystemtimePrivilege 4716 wmic.exe Token: SeProfSingleProcessPrivilege 4716 wmic.exe Token: SeIncBasePriorityPrivilege 4716 wmic.exe Token: SeCreatePagefilePrivilege 4716 wmic.exe Token: SeBackupPrivilege 4716 wmic.exe Token: SeRestorePrivilege 4716 wmic.exe Token: SeShutdownPrivilege 4716 wmic.exe Token: SeDebugPrivilege 4716 wmic.exe Token: SeSystemEnvironmentPrivilege 4716 wmic.exe Token: SeRemoteShutdownPrivilege 4716 wmic.exe Token: SeUndockPrivilege 4716 wmic.exe Token: SeManageVolumePrivilege 4716 wmic.exe Token: 33 4716 wmic.exe Token: 34 4716 wmic.exe Token: 35 4716 wmic.exe Token: 36 4716 wmic.exe Token: SeIncreaseQuotaPrivilege 1904 WMIC.exe Token: SeSecurityPrivilege 1904 WMIC.exe Token: SeTakeOwnershipPrivilege 1904 WMIC.exe Token: SeLoadDriverPrivilege 1904 WMIC.exe Token: SeSystemProfilePrivilege 1904 WMIC.exe Token: SeSystemtimePrivilege 1904 WMIC.exe Token: SeProfSingleProcessPrivilege 1904 WMIC.exe Token: SeIncBasePriorityPrivilege 1904 WMIC.exe Token: SeCreatePagefilePrivilege 1904 WMIC.exe Token: SeBackupPrivilege 1904 WMIC.exe Token: SeRestorePrivilege 1904 WMIC.exe Token: SeShutdownPrivilege 1904 WMIC.exe Token: SeDebugPrivilege 1904 WMIC.exe Token: SeSystemEnvironmentPrivilege 1904 WMIC.exe Token: SeRemoteShutdownPrivilege 1904 WMIC.exe Token: SeUndockPrivilege 1904 WMIC.exe Token: SeManageVolumePrivilege 1904 WMIC.exe Token: 33 1904 WMIC.exe Token: 34 1904 WMIC.exe Token: 35 1904 WMIC.exe Token: 36 1904 WMIC.exe Token: SeIncreaseQuotaPrivilege 1904 WMIC.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4780 wrote to memory of 4716 4780 setup_win64.exe 80 PID 4780 wrote to memory of 4716 4780 setup_win64.exe 80 PID 4780 wrote to memory of 4716 4780 setup_win64.exe 80 PID 4780 wrote to memory of 5096 4780 setup_win64.exe 82 PID 4780 wrote to memory of 5096 4780 setup_win64.exe 82 PID 4780 wrote to memory of 5096 4780 setup_win64.exe 82 PID 5096 wrote to memory of 1904 5096 cmd.exe 84 PID 5096 wrote to memory of 1904 5096 cmd.exe 84 PID 5096 wrote to memory of 1904 5096 cmd.exe 84 PID 4780 wrote to memory of 1696 4780 setup_win64.exe 85 PID 4780 wrote to memory of 1696 4780 setup_win64.exe 85 PID 4780 wrote to memory of 1696 4780 setup_win64.exe 85 PID 1696 wrote to memory of 1240 1696 cmd.exe 87 PID 1696 wrote to memory of 1240 1696 cmd.exe 87 PID 1696 wrote to memory of 1240 1696 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_win64.exe"C:\Users\Admin\AppData\Local\Temp\setup_win64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:1240
-
-