Analysis
-
max time kernel
99s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2023 12:06
Behavioral task
behavioral1
Sample
07b974442b53035b8d057a7b429c191fe71f149a69804.exe
Resource
win7-20230220-en
General
-
Target
07b974442b53035b8d057a7b429c191fe71f149a69804.exe
-
Size
3.0MB
-
MD5
af4268c094f2a9c6e6a85f8626b9a5c7
-
SHA1
7d6b6083ec9081f52517cc7952dfb0c1c416e395
-
SHA256
07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165
-
SHA512
2ab2d4771841ebbeb195d21697c1708db985ae821a7ed3e2bb050c5759fbdb1e7784354fa5611e377a603a6db437e90a7258ecfcbea7703e584330b91eacac68
-
SSDEEP
49152:y2sQ8R/u6S/gPV4PW/vlLr8EdiITRf+EGg7dH1zaSo5hTk6k1qFG:yfQM/fSoPFNLQg1WT5Q
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1264 wmic.exe Token: SeSecurityPrivilege 1264 wmic.exe Token: SeTakeOwnershipPrivilege 1264 wmic.exe Token: SeLoadDriverPrivilege 1264 wmic.exe Token: SeSystemProfilePrivilege 1264 wmic.exe Token: SeSystemtimePrivilege 1264 wmic.exe Token: SeProfSingleProcessPrivilege 1264 wmic.exe Token: SeIncBasePriorityPrivilege 1264 wmic.exe Token: SeCreatePagefilePrivilege 1264 wmic.exe Token: SeBackupPrivilege 1264 wmic.exe Token: SeRestorePrivilege 1264 wmic.exe Token: SeShutdownPrivilege 1264 wmic.exe Token: SeDebugPrivilege 1264 wmic.exe Token: SeSystemEnvironmentPrivilege 1264 wmic.exe Token: SeRemoteShutdownPrivilege 1264 wmic.exe Token: SeUndockPrivilege 1264 wmic.exe Token: SeManageVolumePrivilege 1264 wmic.exe Token: 33 1264 wmic.exe Token: 34 1264 wmic.exe Token: 35 1264 wmic.exe Token: 36 1264 wmic.exe Token: SeIncreaseQuotaPrivilege 1264 wmic.exe Token: SeSecurityPrivilege 1264 wmic.exe Token: SeTakeOwnershipPrivilege 1264 wmic.exe Token: SeLoadDriverPrivilege 1264 wmic.exe Token: SeSystemProfilePrivilege 1264 wmic.exe Token: SeSystemtimePrivilege 1264 wmic.exe Token: SeProfSingleProcessPrivilege 1264 wmic.exe Token: SeIncBasePriorityPrivilege 1264 wmic.exe Token: SeCreatePagefilePrivilege 1264 wmic.exe Token: SeBackupPrivilege 1264 wmic.exe Token: SeRestorePrivilege 1264 wmic.exe Token: SeShutdownPrivilege 1264 wmic.exe Token: SeDebugPrivilege 1264 wmic.exe Token: SeSystemEnvironmentPrivilege 1264 wmic.exe Token: SeRemoteShutdownPrivilege 1264 wmic.exe Token: SeUndockPrivilege 1264 wmic.exe Token: SeManageVolumePrivilege 1264 wmic.exe Token: 33 1264 wmic.exe Token: 34 1264 wmic.exe Token: 35 1264 wmic.exe Token: 36 1264 wmic.exe Token: SeIncreaseQuotaPrivilege 2276 WMIC.exe Token: SeSecurityPrivilege 2276 WMIC.exe Token: SeTakeOwnershipPrivilege 2276 WMIC.exe Token: SeLoadDriverPrivilege 2276 WMIC.exe Token: SeSystemProfilePrivilege 2276 WMIC.exe Token: SeSystemtimePrivilege 2276 WMIC.exe Token: SeProfSingleProcessPrivilege 2276 WMIC.exe Token: SeIncBasePriorityPrivilege 2276 WMIC.exe Token: SeCreatePagefilePrivilege 2276 WMIC.exe Token: SeBackupPrivilege 2276 WMIC.exe Token: SeRestorePrivilege 2276 WMIC.exe Token: SeShutdownPrivilege 2276 WMIC.exe Token: SeDebugPrivilege 2276 WMIC.exe Token: SeSystemEnvironmentPrivilege 2276 WMIC.exe Token: SeRemoteShutdownPrivilege 2276 WMIC.exe Token: SeUndockPrivilege 2276 WMIC.exe Token: SeManageVolumePrivilege 2276 WMIC.exe Token: 33 2276 WMIC.exe Token: 34 2276 WMIC.exe Token: 35 2276 WMIC.exe Token: 36 2276 WMIC.exe Token: SeIncreaseQuotaPrivilege 2276 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
07b974442b53035b8d057a7b429c191fe71f149a69804.execmd.execmd.exedescription pid process target process PID 2100 wrote to memory of 1264 2100 07b974442b53035b8d057a7b429c191fe71f149a69804.exe wmic.exe PID 2100 wrote to memory of 1264 2100 07b974442b53035b8d057a7b429c191fe71f149a69804.exe wmic.exe PID 2100 wrote to memory of 1264 2100 07b974442b53035b8d057a7b429c191fe71f149a69804.exe wmic.exe PID 2100 wrote to memory of 636 2100 07b974442b53035b8d057a7b429c191fe71f149a69804.exe cmd.exe PID 2100 wrote to memory of 636 2100 07b974442b53035b8d057a7b429c191fe71f149a69804.exe cmd.exe PID 2100 wrote to memory of 636 2100 07b974442b53035b8d057a7b429c191fe71f149a69804.exe cmd.exe PID 636 wrote to memory of 2276 636 cmd.exe WMIC.exe PID 636 wrote to memory of 2276 636 cmd.exe WMIC.exe PID 636 wrote to memory of 2276 636 cmd.exe WMIC.exe PID 2100 wrote to memory of 1520 2100 07b974442b53035b8d057a7b429c191fe71f149a69804.exe cmd.exe PID 2100 wrote to memory of 1520 2100 07b974442b53035b8d057a7b429c191fe71f149a69804.exe cmd.exe PID 2100 wrote to memory of 1520 2100 07b974442b53035b8d057a7b429c191fe71f149a69804.exe cmd.exe PID 1520 wrote to memory of 1260 1520 cmd.exe WMIC.exe PID 1520 wrote to memory of 1260 1520 cmd.exe WMIC.exe PID 1520 wrote to memory of 1260 1520 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07b974442b53035b8d057a7b429c191fe71f149a69804.exe"C:\Users\Admin\AppData\Local\Temp\07b974442b53035b8d057a7b429c191fe71f149a69804.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264 -
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276 -
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:1260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaLFilesize
2KB
MD5dce9b749d38fdc247ab517e8a76e6102
SHA1d6c5b6548e1a3da3326bd097c50c49fc7906be3f
SHA2565087b8c7f2cecceac61d7bd02b939888cf2cc5a452676f28fd5c076eb1ae7ea7
SHA51256c276f0a070da656c98520aa720994d78f1bf0bbb085a5f6fb4fd18fed2bbba1eb8e97b54d58eaa9a978d21d64678170f49c020feb19d8545d158a2d8d58446
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
71KB
MD592d24961d2ebaacf1ace5463dfc9930d
SHA199ffaf6904ab616c33a37ce01d383e4a493df335
SHA2569013688dec264c615178e151c2eb5f0b2eb9fe8cfad867b311d8581d921c73f3
SHA51277598c77f219ab5234b8b84bcfe873f40e7464b224fac3c8568b300d3f2563f7ef5ad9ec5cccc0d719e7d3e489a164b04b6b36316196afea0b8051de3c751cc7