Analysis
-
max time kernel
143s -
max time network
184s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
21-02-2023 04:47
Behavioral task
behavioral1
Sample
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe
Resource
win7-20230220-en
General
-
Target
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe
-
Size
4.4MB
-
MD5
15ae1218c1c773497a6a5e6db8d11922
-
SHA1
8596dbd6e5e7dfdfbacd04051d192dd597d72b67
-
SHA256
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf
-
SHA512
57c417052ace7f7e1b4c60da0549e733e6e1bcc35c3c952a0595501248ef25a801e71148d55334aeb38c57a9ecb851476f7c34fab86ee00d319e95ac79f4c45b
-
SSDEEP
49152:yb9BphIVBmo8cBBThHHCrmYVzZLbdIo0MaN5EyKktGH5R7of01N:ipCmo/CrmyVYEqGZR7n
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 4296 powershell.exe 4296 powershell.exe 4296 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 4468 wmic.exe Token: SeSecurityPrivilege 4468 wmic.exe Token: SeTakeOwnershipPrivilege 4468 wmic.exe Token: SeLoadDriverPrivilege 4468 wmic.exe Token: SeSystemProfilePrivilege 4468 wmic.exe Token: SeSystemtimePrivilege 4468 wmic.exe Token: SeProfSingleProcessPrivilege 4468 wmic.exe Token: SeIncBasePriorityPrivilege 4468 wmic.exe Token: SeCreatePagefilePrivilege 4468 wmic.exe Token: SeBackupPrivilege 4468 wmic.exe Token: SeRestorePrivilege 4468 wmic.exe Token: SeShutdownPrivilege 4468 wmic.exe Token: SeDebugPrivilege 4468 wmic.exe Token: SeSystemEnvironmentPrivilege 4468 wmic.exe Token: SeRemoteShutdownPrivilege 4468 wmic.exe Token: SeUndockPrivilege 4468 wmic.exe Token: SeManageVolumePrivilege 4468 wmic.exe Token: 33 4468 wmic.exe Token: 34 4468 wmic.exe Token: 35 4468 wmic.exe Token: 36 4468 wmic.exe Token: SeIncreaseQuotaPrivilege 4468 wmic.exe Token: SeSecurityPrivilege 4468 wmic.exe Token: SeTakeOwnershipPrivilege 4468 wmic.exe Token: SeLoadDriverPrivilege 4468 wmic.exe Token: SeSystemProfilePrivilege 4468 wmic.exe Token: SeSystemtimePrivilege 4468 wmic.exe Token: SeProfSingleProcessPrivilege 4468 wmic.exe Token: SeIncBasePriorityPrivilege 4468 wmic.exe Token: SeCreatePagefilePrivilege 4468 wmic.exe Token: SeBackupPrivilege 4468 wmic.exe Token: SeRestorePrivilege 4468 wmic.exe Token: SeShutdownPrivilege 4468 wmic.exe Token: SeDebugPrivilege 4468 wmic.exe Token: SeSystemEnvironmentPrivilege 4468 wmic.exe Token: SeRemoteShutdownPrivilege 4468 wmic.exe Token: SeUndockPrivilege 4468 wmic.exe Token: SeManageVolumePrivilege 4468 wmic.exe Token: 33 4468 wmic.exe Token: 34 4468 wmic.exe Token: 35 4468 wmic.exe Token: 36 4468 wmic.exe Token: SeIncreaseQuotaPrivilege 820 WMIC.exe Token: SeSecurityPrivilege 820 WMIC.exe Token: SeTakeOwnershipPrivilege 820 WMIC.exe Token: SeLoadDriverPrivilege 820 WMIC.exe Token: SeSystemProfilePrivilege 820 WMIC.exe Token: SeSystemtimePrivilege 820 WMIC.exe Token: SeProfSingleProcessPrivilege 820 WMIC.exe Token: SeIncBasePriorityPrivilege 820 WMIC.exe Token: SeCreatePagefilePrivilege 820 WMIC.exe Token: SeBackupPrivilege 820 WMIC.exe Token: SeRestorePrivilege 820 WMIC.exe Token: SeShutdownPrivilege 820 WMIC.exe Token: SeDebugPrivilege 820 WMIC.exe Token: SeSystemEnvironmentPrivilege 820 WMIC.exe Token: SeRemoteShutdownPrivilege 820 WMIC.exe Token: SeUndockPrivilege 820 WMIC.exe Token: SeManageVolumePrivilege 820 WMIC.exe Token: 33 820 WMIC.exe Token: 34 820 WMIC.exe Token: 35 820 WMIC.exe Token: 36 820 WMIC.exe Token: SeIncreaseQuotaPrivilege 820 WMIC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.execmd.execmd.exedescription pid process target process PID 3272 wrote to memory of 4468 3272 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe wmic.exe PID 3272 wrote to memory of 4468 3272 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe wmic.exe PID 3272 wrote to memory of 4928 3272 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 3272 wrote to memory of 4928 3272 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 4928 wrote to memory of 820 4928 cmd.exe WMIC.exe PID 4928 wrote to memory of 820 4928 cmd.exe WMIC.exe PID 3272 wrote to memory of 4892 3272 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 3272 wrote to memory of 4892 3272 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 4892 wrote to memory of 1940 4892 cmd.exe WMIC.exe PID 4892 wrote to memory of 1940 4892 cmd.exe WMIC.exe PID 3272 wrote to memory of 4296 3272 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe powershell.exe PID 3272 wrote to memory of 4296 3272 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe"C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "start-process C:\Users\Admin\AppData\Local\Temp\gWXXezM8r1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_so1xvjyf.rkr.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\gWXXezM8r1.exeFilesize
11KB
MD519d9c4331e51f909b039ffe4adee1a27
SHA1e31dd6711f14f41c2b5bd09eb4a3ec42d5160811
SHA256b9276d74d1edc9931e333526d5a4ce0ffb45151b9999fc465230c78e23e34531
SHA512f543d27d8b972ec2a1c964cb30d598b7dfcdfb6765bbde51728cf49fac6226144945267814d87185ebd3fa565237d2981a226d78644814446bc43b2c96eddde3
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
71KB
MD595a12fa5756d0040e1c1284371ea17e4
SHA1a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA5121d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5
-
memory/4296-160-0x00000234F13D0000-0x00000234F13F2000-memory.dmpFilesize
136KB
-
memory/4296-164-0x00000234F3680000-0x00000234F36F6000-memory.dmpFilesize
472KB
-
memory/4296-180-0x00000234F1420000-0x00000234F1430000-memory.dmpFilesize
64KB
-
memory/4296-177-0x00000234F1420000-0x00000234F1430000-memory.dmpFilesize
64KB