Analysis
-
max time kernel
52s -
max time network
185s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
20-02-2023 22:17
Behavioral task
behavioral1
Sample
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe
Resource
win7-20220812-en
General
-
Target
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe
-
Size
4.4MB
-
MD5
15ae1218c1c773497a6a5e6db8d11922
-
SHA1
8596dbd6e5e7dfdfbacd04051d192dd597d72b67
-
SHA256
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf
-
SHA512
57c417052ace7f7e1b4c60da0549e733e6e1bcc35c3c952a0595501248ef25a801e71148d55334aeb38c57a9ecb851476f7c34fab86ee00d319e95ac79f4c45b
-
SSDEEP
49152:yb9BphIVBmo8cBBThHHCrmYVzZLbdIo0MaN5EyKktGH5R7of01N:ipCmo/CrmyVYEqGZR7n
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1960 powershell.exe 1960 powershell.exe 1960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 3372 wmic.exe Token: SeSecurityPrivilege 3372 wmic.exe Token: SeTakeOwnershipPrivilege 3372 wmic.exe Token: SeLoadDriverPrivilege 3372 wmic.exe Token: SeSystemProfilePrivilege 3372 wmic.exe Token: SeSystemtimePrivilege 3372 wmic.exe Token: SeProfSingleProcessPrivilege 3372 wmic.exe Token: SeIncBasePriorityPrivilege 3372 wmic.exe Token: SeCreatePagefilePrivilege 3372 wmic.exe Token: SeBackupPrivilege 3372 wmic.exe Token: SeRestorePrivilege 3372 wmic.exe Token: SeShutdownPrivilege 3372 wmic.exe Token: SeDebugPrivilege 3372 wmic.exe Token: SeSystemEnvironmentPrivilege 3372 wmic.exe Token: SeRemoteShutdownPrivilege 3372 wmic.exe Token: SeUndockPrivilege 3372 wmic.exe Token: SeManageVolumePrivilege 3372 wmic.exe Token: 33 3372 wmic.exe Token: 34 3372 wmic.exe Token: 35 3372 wmic.exe Token: 36 3372 wmic.exe Token: SeIncreaseQuotaPrivilege 3372 wmic.exe Token: SeSecurityPrivilege 3372 wmic.exe Token: SeTakeOwnershipPrivilege 3372 wmic.exe Token: SeLoadDriverPrivilege 3372 wmic.exe Token: SeSystemProfilePrivilege 3372 wmic.exe Token: SeSystemtimePrivilege 3372 wmic.exe Token: SeProfSingleProcessPrivilege 3372 wmic.exe Token: SeIncBasePriorityPrivilege 3372 wmic.exe Token: SeCreatePagefilePrivilege 3372 wmic.exe Token: SeBackupPrivilege 3372 wmic.exe Token: SeRestorePrivilege 3372 wmic.exe Token: SeShutdownPrivilege 3372 wmic.exe Token: SeDebugPrivilege 3372 wmic.exe Token: SeSystemEnvironmentPrivilege 3372 wmic.exe Token: SeRemoteShutdownPrivilege 3372 wmic.exe Token: SeUndockPrivilege 3372 wmic.exe Token: SeManageVolumePrivilege 3372 wmic.exe Token: 33 3372 wmic.exe Token: 34 3372 wmic.exe Token: 35 3372 wmic.exe Token: 36 3372 wmic.exe Token: SeIncreaseQuotaPrivilege 4640 WMIC.exe Token: SeSecurityPrivilege 4640 WMIC.exe Token: SeTakeOwnershipPrivilege 4640 WMIC.exe Token: SeLoadDriverPrivilege 4640 WMIC.exe Token: SeSystemProfilePrivilege 4640 WMIC.exe Token: SeSystemtimePrivilege 4640 WMIC.exe Token: SeProfSingleProcessPrivilege 4640 WMIC.exe Token: SeIncBasePriorityPrivilege 4640 WMIC.exe Token: SeCreatePagefilePrivilege 4640 WMIC.exe Token: SeBackupPrivilege 4640 WMIC.exe Token: SeRestorePrivilege 4640 WMIC.exe Token: SeShutdownPrivilege 4640 WMIC.exe Token: SeDebugPrivilege 4640 WMIC.exe Token: SeSystemEnvironmentPrivilege 4640 WMIC.exe Token: SeRemoteShutdownPrivilege 4640 WMIC.exe Token: SeUndockPrivilege 4640 WMIC.exe Token: SeManageVolumePrivilege 4640 WMIC.exe Token: 33 4640 WMIC.exe Token: 34 4640 WMIC.exe Token: 35 4640 WMIC.exe Token: 36 4640 WMIC.exe Token: SeIncreaseQuotaPrivilege 4640 WMIC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.execmd.execmd.exedescription pid process target process PID 3032 wrote to memory of 3372 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe wmic.exe PID 3032 wrote to memory of 3372 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe wmic.exe PID 3032 wrote to memory of 4424 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 3032 wrote to memory of 4424 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 4424 wrote to memory of 4640 4424 cmd.exe WMIC.exe PID 4424 wrote to memory of 4640 4424 cmd.exe WMIC.exe PID 3032 wrote to memory of 4904 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 3032 wrote to memory of 4904 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 4904 wrote to memory of 4332 4904 cmd.exe WMIC.exe PID 4904 wrote to memory of 4332 4904 cmd.exe WMIC.exe PID 3032 wrote to memory of 1960 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe powershell.exe PID 3032 wrote to memory of 1960 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe"C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "start-process C:\Users\Admin\AppData\Local\Temp\Dprrjmi5gZ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Dprrjmi5gZ.exeFilesize
12KB
MD57ebbd259d42e0f20e01e0a336b774311
SHA1d6d69bc9ec62b0fc6cb432bb2af3bfc60e4bd312
SHA25661384aba1c6c68f6f5831d11562eab170190fa82a486ddc0a053f66bdf8d318b
SHA51236d750b6cc370a007329d30bbd70627acedd08c54c62d553f0662a0f9c2026fa2b378ac57d0c802a1ea2c1dee75b73e36b56bd5ef9483e717dea5f0f20ca4d78
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jyxwagpg.pia.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
72KB
MD52b8e1b75b4d4fdf0c640838191ac3946
SHA1dfac012ccaa015f6a9ec5bd1c55ffa7b8074fb7f
SHA25617a69481ffd684f025b0fe6b0f22529bd8454c49915e580da43fcb08a0c56e4e
SHA5123c4de03250813dc78b772cc7e3246ac2726c37fae00844bfceda683e05506b53ba7ea95a06e2929e8ec736ccd50a9138e9f6e3c80980ebde5ed7ac66f06cc038
-
memory/1960-158-0x000001E112D90000-0x000001E112DB2000-memory.dmpFilesize
136KB
-
memory/1960-161-0x000001E12B400000-0x000001E12B476000-memory.dmpFilesize
472KB
-
memory/1960-170-0x000001E12B490000-0x000001E12B4A0000-memory.dmpFilesize
64KB
-
memory/1960-171-0x000001E12B490000-0x000001E12B4A0000-memory.dmpFilesize
64KB