Analysis
- max time kernel
86s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
07/02/2023, 16:06
Static task
static1
Behavioral task
behavioral1
Sample
install_win64-32.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
General
- Target install_win64-32.exe
- Size 337.3MB
- Sample230207-tj4d9sce64
- SHA256 ed21de8db10f9d54777ababb908417b3fa4dc1d6dfd821c4aee312ef35e65687
- MD5 1958b167c0de05e60c48f35529032ff2
- SHA1 4409ceb5b33e19bb7923913429a74a6d1a1af8af
- SHA512 fbf5e94e9d20b745f1336d4050f5a6935cd3b255f3163c535c4f462af545bcbd67c59f26c3ae350c6db2ebc4ed6ec6316f5a4597031860fcf857c0b21a432647
- SSDEEP 24576:r0zKbWfuNzzG+5DnKW4YRt4CUuDk5c9PwWl/Tgqups99VWzgdMI3GKjVS7O3TZp0:r0mbWmNzX5rt94C5Wz5jmGz1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
aurora
C2
-
45.15.156.210:8081
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4864 set thread context of 4748 4864 install_win64-32.exe 82 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2148 wmic.exe Token: SeSecurityPrivilege 2148 wmic.exe Token: SeTakeOwnershipPrivilege 2148 wmic.exe Token: SeLoadDriverPrivilege 2148 wmic.exe Token: SeSystemProfilePrivilege 2148 wmic.exe Token: SeSystemtimePrivilege 2148 wmic.exe Token: SeProfSingleProcessPrivilege 2148 wmic.exe Token: SeIncBasePriorityPrivilege 2148 wmic.exe Token: SeCreatePagefilePrivilege 2148 wmic.exe Token: SeBackupPrivilege 2148 wmic.exe Token: SeRestorePrivilege 2148 wmic.exe Token: SeShutdownPrivilege 2148 wmic.exe Token: SeDebugPrivilege 2148 wmic.exe Token: SeSystemEnvironmentPrivilege 2148 wmic.exe Token: SeRemoteShutdownPrivilege 2148 wmic.exe Token: SeUndockPrivilege 2148 wmic.exe Token: SeManageVolumePrivilege 2148 wmic.exe Token: 33 2148 wmic.exe Token: 34 2148 wmic.exe Token: 35 2148 wmic.exe Token: 36 2148 wmic.exe Token: SeIncreaseQuotaPrivilege 2148 wmic.exe Token: SeSecurityPrivilege 2148 wmic.exe Token: SeTakeOwnershipPrivilege 2148 wmic.exe Token: SeLoadDriverPrivilege 2148 wmic.exe Token: SeSystemProfilePrivilege 2148 wmic.exe Token: SeSystemtimePrivilege 2148 wmic.exe Token: SeProfSingleProcessPrivilege 2148 wmic.exe Token: SeIncBasePriorityPrivilege 2148 wmic.exe Token: SeCreatePagefilePrivilege 2148 wmic.exe Token: SeBackupPrivilege 2148 wmic.exe Token: SeRestorePrivilege 2148 wmic.exe Token: SeShutdownPrivilege 2148 wmic.exe Token: SeDebugPrivilege 2148 wmic.exe Token: SeSystemEnvironmentPrivilege 2148 wmic.exe Token: SeRemoteShutdownPrivilege 2148 wmic.exe Token: SeUndockPrivilege 2148 wmic.exe Token: SeManageVolumePrivilege 2148 wmic.exe Token: 33 2148 wmic.exe Token: 34 2148 wmic.exe Token: 35 2148 wmic.exe Token: 36 2148 wmic.exe Token: SeIncreaseQuotaPrivilege 1172 WMIC.exe Token: SeSecurityPrivilege 1172 WMIC.exe Token: SeTakeOwnershipPrivilege 1172 WMIC.exe Token: SeLoadDriverPrivilege 1172 WMIC.exe Token: SeSystemProfilePrivilege 1172 WMIC.exe Token: SeSystemtimePrivilege 1172 WMIC.exe Token: SeProfSingleProcessPrivilege 1172 WMIC.exe Token: SeIncBasePriorityPrivilege 1172 WMIC.exe Token: SeCreatePagefilePrivilege 1172 WMIC.exe Token: SeBackupPrivilege 1172 WMIC.exe Token: SeRestorePrivilege 1172 WMIC.exe Token: SeShutdownPrivilege 1172 WMIC.exe Token: SeDebugPrivilege 1172 WMIC.exe Token: SeSystemEnvironmentPrivilege 1172 WMIC.exe Token: SeRemoteShutdownPrivilege 1172 WMIC.exe Token: SeUndockPrivilege 1172 WMIC.exe Token: SeManageVolumePrivilege 1172 WMIC.exe Token: 33 1172 WMIC.exe Token: 34 1172 WMIC.exe Token: 35 1172 WMIC.exe Token: 36 1172 WMIC.exe Token: SeIncreaseQuotaPrivilege 1172 WMIC.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4864 wrote to memory of 4748 4864 install_win64-32.exe 82 PID 4748 wrote to memory of 2148 4748 install_win64-32.exe 83 PID 4748 wrote to memory of 2148 4748 install_win64-32.exe 83 PID 4748 wrote to memory of 1396 4748 install_win64-32.exe 85 PID 4748 wrote to memory of 1396 4748 install_win64-32.exe 85 PID 1396 wrote to memory of 1172 1396 cmd.exe 87 PID 1396 wrote to memory of 1172 1396 cmd.exe 87 PID 4748 wrote to memory of 1436 4748 install_win64-32.exe 88 PID 4748 wrote to memory of 1436 4748 install_win64-32.exe 88 PID 1436 wrote to memory of 4808 1436 cmd.exe 90 PID 1436 wrote to memory of 4808 1436 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\install_win64-32.exe"C:\Users\Admin\AppData\Local\Temp\install_win64-32.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\install_win64-32.exe"C:\Users\Admin\AppData\Local\Temp\install_win64-32.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵PID:4808
-
-
-