Analysis
- max time kernel
45s - max time network
49s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
07/02/2023, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
300 seconds
General
- Target 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe
- Size 7.3MB
- Sample230207-17k16afc8x
- SHA256 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab
- MD5 7d26dce6ba89dedbd27455167f0a3044
- SHA1 19e3b77457a387ab5089b276056af074d0f8e77a
- SHA512 a474a6cd9a9195389a631f5f7637e212fe4f89f2d848a85acfa2778c5efc4c69047196ae6d7f78254fc600ebc00e2faf9d6bfeb2ac7c43f31062d7d827077f6d
- SSDEEP 24576:T0zKbWffNzzG+5DnKW4YRcTCDyO+QlehV7UC7vNbMWA9qIZ/QD83qZ/gbaq/EqJO:T0mbW3NzX5rtsTCAWtKCRGz1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
aurora
C2
-
45.15.156.210:8081
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 860 set thread context of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1740 wmic.exe Token: SeSecurityPrivilege 1740 wmic.exe Token: SeTakeOwnershipPrivilege 1740 wmic.exe Token: SeLoadDriverPrivilege 1740 wmic.exe Token: SeSystemProfilePrivilege 1740 wmic.exe Token: SeSystemtimePrivilege 1740 wmic.exe Token: SeProfSingleProcessPrivilege 1740 wmic.exe Token: SeIncBasePriorityPrivilege 1740 wmic.exe Token: SeCreatePagefilePrivilege 1740 wmic.exe Token: SeBackupPrivilege 1740 wmic.exe Token: SeRestorePrivilege 1740 wmic.exe Token: SeShutdownPrivilege 1740 wmic.exe Token: SeDebugPrivilege 1740 wmic.exe Token: SeSystemEnvironmentPrivilege 1740 wmic.exe Token: SeRemoteShutdownPrivilege 1740 wmic.exe Token: SeUndockPrivilege 1740 wmic.exe Token: SeManageVolumePrivilege 1740 wmic.exe Token: 33 1740 wmic.exe Token: 34 1740 wmic.exe Token: 35 1740 wmic.exe Token: SeIncreaseQuotaPrivilege 1740 wmic.exe Token: SeSecurityPrivilege 1740 wmic.exe Token: SeTakeOwnershipPrivilege 1740 wmic.exe Token: SeLoadDriverPrivilege 1740 wmic.exe Token: SeSystemProfilePrivilege 1740 wmic.exe Token: SeSystemtimePrivilege 1740 wmic.exe Token: SeProfSingleProcessPrivilege 1740 wmic.exe Token: SeIncBasePriorityPrivilege 1740 wmic.exe Token: SeCreatePagefilePrivilege 1740 wmic.exe Token: SeBackupPrivilege 1740 wmic.exe Token: SeRestorePrivilege 1740 wmic.exe Token: SeShutdownPrivilege 1740 wmic.exe Token: SeDebugPrivilege 1740 wmic.exe Token: SeSystemEnvironmentPrivilege 1740 wmic.exe Token: SeRemoteShutdownPrivilege 1740 wmic.exe Token: SeUndockPrivilege 1740 wmic.exe Token: SeManageVolumePrivilege 1740 wmic.exe Token: 33 1740 wmic.exe Token: 34 1740 wmic.exe Token: 35 1740 wmic.exe Token: SeIncreaseQuotaPrivilege 1512 WMIC.exe Token: SeSecurityPrivilege 1512 WMIC.exe Token: SeTakeOwnershipPrivilege 1512 WMIC.exe Token: SeLoadDriverPrivilege 1512 WMIC.exe Token: SeSystemProfilePrivilege 1512 WMIC.exe Token: SeSystemtimePrivilege 1512 WMIC.exe Token: SeProfSingleProcessPrivilege 1512 WMIC.exe Token: SeIncBasePriorityPrivilege 1512 WMIC.exe Token: SeCreatePagefilePrivilege 1512 WMIC.exe Token: SeBackupPrivilege 1512 WMIC.exe Token: SeRestorePrivilege 1512 WMIC.exe Token: SeShutdownPrivilege 1512 WMIC.exe Token: SeDebugPrivilege 1512 WMIC.exe Token: SeSystemEnvironmentPrivilege 1512 WMIC.exe Token: SeRemoteShutdownPrivilege 1512 WMIC.exe Token: SeUndockPrivilege 1512 WMIC.exe Token: SeManageVolumePrivilege 1512 WMIC.exe Token: 33 1512 WMIC.exe Token: 34 1512 WMIC.exe Token: 35 1512 WMIC.exe Token: SeIncreaseQuotaPrivilege 1512 WMIC.exe Token: SeSecurityPrivilege 1512 WMIC.exe Token: SeTakeOwnershipPrivilege 1512 WMIC.exe Token: SeLoadDriverPrivilege 1512 WMIC.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 860 wrote to memory of 1976 860 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 28 PID 1976 wrote to memory of 1740 1976 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 29 PID 1976 wrote to memory of 1740 1976 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 29 PID 1976 wrote to memory of 1740 1976 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 29 PID 1976 wrote to memory of 1012 1976 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 32 PID 1976 wrote to memory of 1012 1976 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 32 PID 1976 wrote to memory of 1012 1976 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 32 PID 1012 wrote to memory of 1512 1012 cmd.exe 34 PID 1012 wrote to memory of 1512 1012 cmd.exe 34 PID 1012 wrote to memory of 1512 1012 cmd.exe 34 PID 1976 wrote to memory of 1944 1976 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 35 PID 1976 wrote to memory of 1944 1976 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 35 PID 1976 wrote to memory of 1944 1976 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 35 PID 1944 wrote to memory of 268 1944 cmd.exe 37 PID 1944 wrote to memory of 268 1944 cmd.exe 37 PID 1944 wrote to memory of 268 1944 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe"C:\Users\Admin\AppData\Local\Temp\21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe"C:\Users\Admin\AppData\Local\Temp\21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵PID:268
-
-
-