Analysis
- max time kernel
88s - max time network
91s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system - submitted
22/02/2023, 02:52
Behavioral task
behavioral1
Sample
14711577406a5d442440b680200c3e2837cdbefe8416f.exe
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
General
- Target 14711577406a5d442440b680200c3e2837cdbefe8416f.exe
- Size 4.4MB
- Sample230222-dcqltshe78
- SHA256 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf
- MD5 15ae1218c1c773497a6a5e6db8d11922
- SHA1 8596dbd6e5e7dfdfbacd04051d192dd597d72b67
- SHA512 57c417052ace7f7e1b4c60da0549e733e6e1bcc35c3c952a0595501248ef25a801e71148d55334aeb38c57a9ecb851476f7c34fab86ee00d319e95ac79f4c45b
- SSDEEP 49152:yb9BphIVBmo8cBBThHHCrmYVzZLbdIo0MaN5EyKktGH5R7of01N:ipCmo/CrmyVYEqGZR7n
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 14711577406a5d442440b680200c3e2837cdbefe8416f.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3140 powershell.exe 3140 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4944 wmic.exe Token: SeSecurityPrivilege 4944 wmic.exe Token: SeTakeOwnershipPrivilege 4944 wmic.exe Token: SeLoadDriverPrivilege 4944 wmic.exe Token: SeSystemProfilePrivilege 4944 wmic.exe Token: SeSystemtimePrivilege 4944 wmic.exe Token: SeProfSingleProcessPrivilege 4944 wmic.exe Token: SeIncBasePriorityPrivilege 4944 wmic.exe Token: SeCreatePagefilePrivilege 4944 wmic.exe Token: SeBackupPrivilege 4944 wmic.exe Token: SeRestorePrivilege 4944 wmic.exe Token: SeShutdownPrivilege 4944 wmic.exe Token: SeDebugPrivilege 4944 wmic.exe Token: SeSystemEnvironmentPrivilege 4944 wmic.exe Token: SeRemoteShutdownPrivilege 4944 wmic.exe Token: SeUndockPrivilege 4944 wmic.exe Token: SeManageVolumePrivilege 4944 wmic.exe Token: 33 4944 wmic.exe Token: 34 4944 wmic.exe Token: 35 4944 wmic.exe Token: 36 4944 wmic.exe Token: SeIncreaseQuotaPrivilege 4944 wmic.exe Token: SeSecurityPrivilege 4944 wmic.exe Token: SeTakeOwnershipPrivilege 4944 wmic.exe Token: SeLoadDriverPrivilege 4944 wmic.exe Token: SeSystemProfilePrivilege 4944 wmic.exe Token: SeSystemtimePrivilege 4944 wmic.exe Token: SeProfSingleProcessPrivilege 4944 wmic.exe Token: SeIncBasePriorityPrivilege 4944 wmic.exe Token: SeCreatePagefilePrivilege 4944 wmic.exe Token: SeBackupPrivilege 4944 wmic.exe Token: SeRestorePrivilege 4944 wmic.exe Token: SeShutdownPrivilege 4944 wmic.exe Token: SeDebugPrivilege 4944 wmic.exe Token: SeSystemEnvironmentPrivilege 4944 wmic.exe Token: SeRemoteShutdownPrivilege 4944 wmic.exe Token: SeUndockPrivilege 4944 wmic.exe Token: SeManageVolumePrivilege 4944 wmic.exe Token: 33 4944 wmic.exe Token: 34 4944 wmic.exe Token: 35 4944 wmic.exe Token: 36 4944 wmic.exe Token: SeIncreaseQuotaPrivilege 5116 WMIC.exe Token: SeSecurityPrivilege 5116 WMIC.exe Token: SeTakeOwnershipPrivilege 5116 WMIC.exe Token: SeLoadDriverPrivilege 5116 WMIC.exe Token: SeSystemProfilePrivilege 5116 WMIC.exe Token: SeSystemtimePrivilege 5116 WMIC.exe Token: SeProfSingleProcessPrivilege 5116 WMIC.exe Token: SeIncBasePriorityPrivilege 5116 WMIC.exe Token: SeCreatePagefilePrivilege 5116 WMIC.exe Token: SeBackupPrivilege 5116 WMIC.exe Token: SeRestorePrivilege 5116 WMIC.exe Token: SeShutdownPrivilege 5116 WMIC.exe Token: SeDebugPrivilege 5116 WMIC.exe Token: SeSystemEnvironmentPrivilege 5116 WMIC.exe Token: SeRemoteShutdownPrivilege 5116 WMIC.exe Token: SeUndockPrivilege 5116 WMIC.exe Token: SeManageVolumePrivilege 5116 WMIC.exe Token: 33 5116 WMIC.exe Token: 34 5116 WMIC.exe Token: 35 5116 WMIC.exe Token: 36 5116 WMIC.exe Token: SeIncreaseQuotaPrivilege 5116 WMIC.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5024 wrote to memory of 4944 5024 14711577406a5d442440b680200c3e2837cdbefe8416f.exe 80 PID 5024 wrote to memory of 4944 5024 14711577406a5d442440b680200c3e2837cdbefe8416f.exe 80 PID 5024 wrote to memory of 4936 5024 14711577406a5d442440b680200c3e2837cdbefe8416f.exe 82 PID 5024 wrote to memory of 4936 5024 14711577406a5d442440b680200c3e2837cdbefe8416f.exe 82 PID 4936 wrote to memory of 5116 4936 cmd.exe 84 PID 4936 wrote to memory of 5116 4936 cmd.exe 84 PID 5024 wrote to memory of 1172 5024 14711577406a5d442440b680200c3e2837cdbefe8416f.exe 85 PID 5024 wrote to memory of 1172 5024 14711577406a5d442440b680200c3e2837cdbefe8416f.exe 85 PID 1172 wrote to memory of 5100 1172 cmd.exe 87 PID 1172 wrote to memory of 5100 1172 cmd.exe 87 PID 5024 wrote to memory of 3140 5024 14711577406a5d442440b680200c3e2837cdbefe8416f.exe 88 PID 5024 wrote to memory of 3140 5024 14711577406a5d442440b680200c3e2837cdbefe8416f.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f.exe"C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:5100
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "start-process C:\Users\Admin\AppData\Local\Temp\TnP1MldUd6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3140
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL
- Size 2KB
- SHA256 662f6389650db2471a13412664d05cfed46fef73dd1d30cf16d2c8ceeee33eb0
- MD5 18da5c19d469f921ff9d44f1f17de97b
- SHA1 bef606053494e1f516431d40f2aca29cf1deeb20
- SHA512 9eee1b05c10544813c2eb89c48369d78e5b9260fddd8e90a34f06ac8ea2955860083c6c8ac31089276e97e269b87b4ac0c43e9dcdb7bd6091759dccb4ac0e71d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TnP1MldUd6.exe
- Size 12KB
- SHA256 f06a773b225de1125aa1431fb13bdc49e53c3694abdd8f5b18dafcb25d43bfc2
- MD5 41cfc4dc9ad81066abd676e9ff990f6d
- SHA1 13af7f04fd13f34d6cf501e89dc16210eba886ae
- SHA512 a02d3659868043bc22550a035a223b8c8b8b9d46ad1477647d65b9560ab661ebac8f99732fd43a13264cbbc37d4bdceae84d603149ff3a1206528669c078753b
- SSDEEP 192:/HIoApxpQJ/r8cLQJsIupQZwEmP6BL+eLZG7YEfbp0USiJyv:AosxpQF9ccQZwEfBL+eLZG7DbKnt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_233kezb5.whi.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
- Size 71KB
- SHA256 5954db23a8424f6cb1e933387d0866910c45615f54342aa0f6dd597174393de6
- MD5 46988a922937a39036d6b71e62d0f966
- SHA1 4a997f2a0360274ec7990aac156870a5a7030665
- SHA512 dd7774668cd24c303e670e7d096794aca67593b8d8a9b3b38aa08c148f67e74c07041f25941465b3ae030bafd76384b4b79d41c1eeebe5bd11d94ab25ef00e9d
- SSDEEP 1536:+fYk/Q/OccbxYiWU/vXyVOlgZiHGOM7nF+ABbauqzgG:+fH/Q/6Zp/viVwg0GOM7VzG
- MD5 SHA1 SHA512 SSDEEP