Analysis

  • max time kernel
    31s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22-02-2023 02:52

General

  • Target

    14711577406a5d442440b680200c3e2837cdbefe8416f.exe

  • Size

    4.4MB

  • MD5

    15ae1218c1c773497a6a5e6db8d11922

  • SHA1

    8596dbd6e5e7dfdfbacd04051d192dd597d72b67

  • SHA256

    14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf

  • SHA512

    57c417052ace7f7e1b4c60da0549e733e6e1bcc35c3c952a0595501248ef25a801e71148d55334aeb38c57a9ecb851476f7c34fab86ee00d319e95ac79f4c45b

  • SSDEEP

    49152:yb9BphIVBmo8cBBThHHCrmYVzZLbdIo0MaN5EyKktGH5R7of01N:ipCmo/CrmyVYEqGZR7n

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f.exe
    "C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:904
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic path win32_VideoController get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic path win32_VideoController get name
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1084
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic cpu get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:304
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic cpu get name
        3⤵
          PID:1128
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell "" "start-process C:\Users\Admin\AppData\Local\Temp\Uq1kXSrxz5.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1168

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e98de880f3d9c291fd9237b04b2ac79b

      SHA1

      249400e135106d9fcd2b66d4b876193edf57b94b

      SHA256

      a3d8971943dc6043874b615c737d0cd206c190d7e7ce0624d61290b6a1e472d2

      SHA512

      31384d49b3059310ba253ed0e05bcc76ba3a938ae99427b2c85beed2fdf3c7175d2e30443f5710476a8ee6622a95013b2a3d4f4b2ae7177a31749d764bf58cbe

    • C:\Users\Admin\AppData\Local\Temp\Cab43C7.tmp

      Filesize

      61KB

      MD5

      fc4666cbca561e864e7fdf883a9e6661

      SHA1

      2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

      SHA256

      10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

      SHA512

      c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

    • C:\Users\Admin\AppData\Local\Temp\Tar4437.tmp

      Filesize

      161KB

      MD5

      73b4b714b42fc9a6aaefd0ae59adb009

      SHA1

      efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

      SHA256

      c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

      SHA512

      73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

    • C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot

      Filesize

      71KB

      MD5

      dfeffc3924409d9c9d3c8cae05be922b

      SHA1

      a89046cbf54c00e17ff0a5f3e1a8f01eb399bce4

      SHA256

      06ea3ad1c1c1067bfdfaa5ad8a91632fac6cad9776ded85fa65d3b6181d89be6

      SHA512

      d9614ecf528a2bf48cafe99a4c54d5c9f3656d628001fbf575d367d5ad8008cf30a58a7b3d9489d8534064442df89a7263df4a91d0863dcd6cc33574c576da33

    • C:\Users\Admin\AppData\Local\Temp\Uq1kXSrxz5.exe

      Filesize

      11KB

      MD5

      4f20ea32a5c8449220933c84891a8c2e

      SHA1

      2e5299601b0e021ff4ac9e1e62a8f53c725ce8a5

      SHA256

      eb06ea73dfc13f304b41fa7f5a7212b0800d9abbb08e47a321ac0d998626f073

      SHA512

      0dc34129c072aefd690f075b75fc3e46684d827060b97ad530a0729681a471732766dfd970cd90208db81d1a218936209bd89e7b3f60876ecb2f3543d422fad1

    • memory/1168-151-0x000000001B190000-0x000000001B472000-memory.dmp

      Filesize

      2.9MB

    • memory/1168-152-0x00000000023E0000-0x00000000023E8000-memory.dmp

      Filesize

      32KB

    • memory/1168-153-0x00000000026B0000-0x0000000002730000-memory.dmp

      Filesize

      512KB

    • memory/1168-154-0x00000000026B0000-0x0000000002730000-memory.dmp

      Filesize

      512KB

    • memory/1168-155-0x00000000026B0000-0x0000000002730000-memory.dmp

      Filesize

      512KB

    • memory/1168-157-0x00000000026BB000-0x00000000026F2000-memory.dmp

      Filesize

      220KB