Analysis
- max time kernel
50s - max time network
174s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system - submitted
07/02/2023, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
300 seconds
General
- Target 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe
- Size 7.3MB
- Sample230207-17k16afc8x
- SHA256 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab
- MD5 7d26dce6ba89dedbd27455167f0a3044
- SHA1 19e3b77457a387ab5089b276056af074d0f8e77a
- SHA512 a474a6cd9a9195389a631f5f7637e212fe4f89f2d848a85acfa2778c5efc4c69047196ae6d7f78254fc600ebc00e2faf9d6bfeb2ac7c43f31062d7d827077f6d
- SSDEEP 24576:T0zKbWffNzzG+5DnKW4YRcTCDyO+QlehV7UC7vNbMWA9qIZ/QD83qZ/gbaq/EqJO:T0mbW3NzX5rtsTCAWtKCRGz1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
aurora
C2
-
45.15.156.210:8081
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2332 set thread context of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2916 wmic.exe Token: SeSecurityPrivilege 2916 wmic.exe Token: SeTakeOwnershipPrivilege 2916 wmic.exe Token: SeLoadDriverPrivilege 2916 wmic.exe Token: SeSystemProfilePrivilege 2916 wmic.exe Token: SeSystemtimePrivilege 2916 wmic.exe Token: SeProfSingleProcessPrivilege 2916 wmic.exe Token: SeIncBasePriorityPrivilege 2916 wmic.exe Token: SeCreatePagefilePrivilege 2916 wmic.exe Token: SeBackupPrivilege 2916 wmic.exe Token: SeRestorePrivilege 2916 wmic.exe Token: SeShutdownPrivilege 2916 wmic.exe Token: SeDebugPrivilege 2916 wmic.exe Token: SeSystemEnvironmentPrivilege 2916 wmic.exe Token: SeRemoteShutdownPrivilege 2916 wmic.exe Token: SeUndockPrivilege 2916 wmic.exe Token: SeManageVolumePrivilege 2916 wmic.exe Token: 33 2916 wmic.exe Token: 34 2916 wmic.exe Token: 35 2916 wmic.exe Token: 36 2916 wmic.exe Token: SeIncreaseQuotaPrivilege 2916 wmic.exe Token: SeSecurityPrivilege 2916 wmic.exe Token: SeTakeOwnershipPrivilege 2916 wmic.exe Token: SeLoadDriverPrivilege 2916 wmic.exe Token: SeSystemProfilePrivilege 2916 wmic.exe Token: SeSystemtimePrivilege 2916 wmic.exe Token: SeProfSingleProcessPrivilege 2916 wmic.exe Token: SeIncBasePriorityPrivilege 2916 wmic.exe Token: SeCreatePagefilePrivilege 2916 wmic.exe Token: SeBackupPrivilege 2916 wmic.exe Token: SeRestorePrivilege 2916 wmic.exe Token: SeShutdownPrivilege 2916 wmic.exe Token: SeDebugPrivilege 2916 wmic.exe Token: SeSystemEnvironmentPrivilege 2916 wmic.exe Token: SeRemoteShutdownPrivilege 2916 wmic.exe Token: SeUndockPrivilege 2916 wmic.exe Token: SeManageVolumePrivilege 2916 wmic.exe Token: 33 2916 wmic.exe Token: 34 2916 wmic.exe Token: 35 2916 wmic.exe Token: 36 2916 wmic.exe Token: SeIncreaseQuotaPrivilege 4956 WMIC.exe Token: SeSecurityPrivilege 4956 WMIC.exe Token: SeTakeOwnershipPrivilege 4956 WMIC.exe Token: SeLoadDriverPrivilege 4956 WMIC.exe Token: SeSystemProfilePrivilege 4956 WMIC.exe Token: SeSystemtimePrivilege 4956 WMIC.exe Token: SeProfSingleProcessPrivilege 4956 WMIC.exe Token: SeIncBasePriorityPrivilege 4956 WMIC.exe Token: SeCreatePagefilePrivilege 4956 WMIC.exe Token: SeBackupPrivilege 4956 WMIC.exe Token: SeRestorePrivilege 4956 WMIC.exe Token: SeShutdownPrivilege 4956 WMIC.exe Token: SeDebugPrivilege 4956 WMIC.exe Token: SeSystemEnvironmentPrivilege 4956 WMIC.exe Token: SeRemoteShutdownPrivilege 4956 WMIC.exe Token: SeUndockPrivilege 4956 WMIC.exe Token: SeManageVolumePrivilege 4956 WMIC.exe Token: 33 4956 WMIC.exe Token: 34 4956 WMIC.exe Token: 35 4956 WMIC.exe Token: 36 4956 WMIC.exe Token: SeIncreaseQuotaPrivilege 4956 WMIC.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2332 wrote to memory of 2460 2332 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 66 PID 2460 wrote to memory of 2916 2460 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 67 PID 2460 wrote to memory of 2916 2460 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 67 PID 2460 wrote to memory of 4040 2460 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 70 PID 2460 wrote to memory of 4040 2460 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 70 PID 4040 wrote to memory of 4956 4040 cmd.exe 72 PID 4040 wrote to memory of 4956 4040 cmd.exe 72 PID 2460 wrote to memory of 3584 2460 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 73 PID 2460 wrote to memory of 3584 2460 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe 73 PID 3584 wrote to memory of 4304 3584 cmd.exe 75 PID 3584 wrote to memory of 4304 3584 cmd.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe"C:\Users\Admin\AppData\Local\Temp\21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe"C:\Users\Admin\AppData\Local\Temp\21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵PID:4304
-
-
-