Analysis
-
max time kernel
50s -
max time network
177s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
22-02-2023 22:23
Behavioral task
behavioral1
Sample
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe
Resource
win7-20230220-en
General
-
Target
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe
-
Size
4.4MB
-
MD5
15ae1218c1c773497a6a5e6db8d11922
-
SHA1
8596dbd6e5e7dfdfbacd04051d192dd597d72b67
-
SHA256
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf
-
SHA512
57c417052ace7f7e1b4c60da0549e733e6e1bcc35c3c952a0595501248ef25a801e71148d55334aeb38c57a9ecb851476f7c34fab86ee00d319e95ac79f4c45b
-
SSDEEP
49152:yb9BphIVBmo8cBBThHHCrmYVzZLbdIo0MaN5EyKktGH5R7of01N:ipCmo/CrmyVYEqGZR7n
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1356 powershell.exe 1356 powershell.exe 1356 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1684 wmic.exe Token: SeSecurityPrivilege 1684 wmic.exe Token: SeTakeOwnershipPrivilege 1684 wmic.exe Token: SeLoadDriverPrivilege 1684 wmic.exe Token: SeSystemProfilePrivilege 1684 wmic.exe Token: SeSystemtimePrivilege 1684 wmic.exe Token: SeProfSingleProcessPrivilege 1684 wmic.exe Token: SeIncBasePriorityPrivilege 1684 wmic.exe Token: SeCreatePagefilePrivilege 1684 wmic.exe Token: SeBackupPrivilege 1684 wmic.exe Token: SeRestorePrivilege 1684 wmic.exe Token: SeShutdownPrivilege 1684 wmic.exe Token: SeDebugPrivilege 1684 wmic.exe Token: SeSystemEnvironmentPrivilege 1684 wmic.exe Token: SeRemoteShutdownPrivilege 1684 wmic.exe Token: SeUndockPrivilege 1684 wmic.exe Token: SeManageVolumePrivilege 1684 wmic.exe Token: 33 1684 wmic.exe Token: 34 1684 wmic.exe Token: 35 1684 wmic.exe Token: 36 1684 wmic.exe Token: SeIncreaseQuotaPrivilege 1684 wmic.exe Token: SeSecurityPrivilege 1684 wmic.exe Token: SeTakeOwnershipPrivilege 1684 wmic.exe Token: SeLoadDriverPrivilege 1684 wmic.exe Token: SeSystemProfilePrivilege 1684 wmic.exe Token: SeSystemtimePrivilege 1684 wmic.exe Token: SeProfSingleProcessPrivilege 1684 wmic.exe Token: SeIncBasePriorityPrivilege 1684 wmic.exe Token: SeCreatePagefilePrivilege 1684 wmic.exe Token: SeBackupPrivilege 1684 wmic.exe Token: SeRestorePrivilege 1684 wmic.exe Token: SeShutdownPrivilege 1684 wmic.exe Token: SeDebugPrivilege 1684 wmic.exe Token: SeSystemEnvironmentPrivilege 1684 wmic.exe Token: SeRemoteShutdownPrivilege 1684 wmic.exe Token: SeUndockPrivilege 1684 wmic.exe Token: SeManageVolumePrivilege 1684 wmic.exe Token: 33 1684 wmic.exe Token: 34 1684 wmic.exe Token: 35 1684 wmic.exe Token: 36 1684 wmic.exe Token: SeIncreaseQuotaPrivilege 1416 WMIC.exe Token: SeSecurityPrivilege 1416 WMIC.exe Token: SeTakeOwnershipPrivilege 1416 WMIC.exe Token: SeLoadDriverPrivilege 1416 WMIC.exe Token: SeSystemProfilePrivilege 1416 WMIC.exe Token: SeSystemtimePrivilege 1416 WMIC.exe Token: SeProfSingleProcessPrivilege 1416 WMIC.exe Token: SeIncBasePriorityPrivilege 1416 WMIC.exe Token: SeCreatePagefilePrivilege 1416 WMIC.exe Token: SeBackupPrivilege 1416 WMIC.exe Token: SeRestorePrivilege 1416 WMIC.exe Token: SeShutdownPrivilege 1416 WMIC.exe Token: SeDebugPrivilege 1416 WMIC.exe Token: SeSystemEnvironmentPrivilege 1416 WMIC.exe Token: SeRemoteShutdownPrivilege 1416 WMIC.exe Token: SeUndockPrivilege 1416 WMIC.exe Token: SeManageVolumePrivilege 1416 WMIC.exe Token: 33 1416 WMIC.exe Token: 34 1416 WMIC.exe Token: 35 1416 WMIC.exe Token: 36 1416 WMIC.exe Token: SeIncreaseQuotaPrivilege 1416 WMIC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.execmd.execmd.exedescription pid process target process PID 1476 wrote to memory of 1684 1476 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe wmic.exe PID 1476 wrote to memory of 1684 1476 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe wmic.exe PID 1476 wrote to memory of 4064 1476 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 1476 wrote to memory of 4064 1476 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 4064 wrote to memory of 1416 4064 cmd.exe WMIC.exe PID 4064 wrote to memory of 1416 4064 cmd.exe WMIC.exe PID 1476 wrote to memory of 2764 1476 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 1476 wrote to memory of 2764 1476 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe cmd.exe PID 2764 wrote to memory of 3768 2764 cmd.exe WMIC.exe PID 2764 wrote to memory of 3768 2764 cmd.exe WMIC.exe PID 1476 wrote to memory of 1356 1476 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe powershell.exe PID 1476 wrote to memory of 1356 1476 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe"C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "start-process C:\Users\Admin\AppData\Local\Temp\W2KYJXflxl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\W2KYJXflxl.exeFilesize
12KB
MD5ae017a169b140ecd735076623fbbf2b6
SHA114d075fc7c3b054677acdbbdb9ff6e34972a1f1d
SHA256c65f669749c1ca5bb29717a2ef1b189f52f2f50bad9f81563c2ca4f15418dae9
SHA512d26bb830e33a438ab9e200f2dadfde600d083666383269bc06ee0dcc34a4462c546c23d249c230004a0767fb253f26a060cc99965ff2c9998b1a155447d09f0e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a4ty45kd.1e2.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
71KB
MD595a12fa5756d0040e1c1284371ea17e4
SHA1a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA5121d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5
-
memory/1356-160-0x0000020175E90000-0x0000020175EA0000-memory.dmpFilesize
64KB
-
memory/1356-161-0x0000020175E90000-0x0000020175EA0000-memory.dmpFilesize
64KB
-
memory/1356-162-0x0000020175DF0000-0x0000020175E12000-memory.dmpFilesize
136KB
-
memory/1356-166-0x00000201780F0000-0x0000020178166000-memory.dmpFilesize
472KB
-
memory/1356-198-0x0000020175E90000-0x0000020175EA0000-memory.dmpFilesize
64KB