1bb3d1cfe99f7dcc5898431a3329c39eb6ca9d2e39072c83d469b3898c1a124f

General

Target

2daf6321a7fb96cd0834ebd018e67dc2.exe
Size

3.0MB
MD5

2daf6321a7fb96cd0834ebd018e67dc2
SHA1

a5a919af73f94ac824ee77df9c140a3a616518e8
SHA256

1bb3d1cfe99f7dcc5898431a3329c39eb6ca9d2e39072c83d469b3898c1a124f
SHA512

210a04c1d2397acc1d199b48076c7b7d434b4cfe02e25d090b95bd4ffe9cf29a17e4d849762657f033e1bd5cf40f319122e799d30ce80ad8176715b2ac7d6450
SSDEEP

49152:5Lx3cqFBYdH3EQK1EsBgcPaVsLFA8p9u1Xk1:02YEB1LO8p

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1056	wmic.exe
Token: SeSecurityPrivilege	1056	wmic.exe
Token: SeTakeOwnershipPrivilege	1056	wmic.exe
Token: SeLoadDriverPrivilege	1056	wmic.exe
Token: SeSystemProfilePrivilege	1056	wmic.exe
Token: SeSystemtimePrivilege	1056	wmic.exe
Token: SeProfSingleProcessPrivilege	1056	wmic.exe
Token: SeIncBasePriorityPrivilege	1056	wmic.exe
Token: SeCreatePagefilePrivilege	1056	wmic.exe
Token: SeBackupPrivilege	1056	wmic.exe
Token: SeRestorePrivilege	1056	wmic.exe
Token: SeShutdownPrivilege	1056	wmic.exe
Token: SeDebugPrivilege	1056	wmic.exe
Token: SeSystemEnvironmentPrivilege	1056	wmic.exe
Token: SeRemoteShutdownPrivilege	1056	wmic.exe
Token: SeUndockPrivilege	1056	wmic.exe
Token: SeManageVolumePrivilege	1056	wmic.exe
Token: 33	1056	wmic.exe
Token: 34	1056	wmic.exe
Token: 35	1056	wmic.exe
Token: SeIncreaseQuotaPrivilege	1056	wmic.exe
Token: SeSecurityPrivilege	1056	wmic.exe
Token: SeTakeOwnershipPrivilege	1056	wmic.exe
Token: SeLoadDriverPrivilege	1056	wmic.exe
Token: SeSystemProfilePrivilege	1056	wmic.exe
Token: SeSystemtimePrivilege	1056	wmic.exe
Token: SeProfSingleProcessPrivilege	1056	wmic.exe
Token: SeIncBasePriorityPrivilege	1056	wmic.exe
Token: SeCreatePagefilePrivilege	1056	wmic.exe
Token: SeBackupPrivilege	1056	wmic.exe
Token: SeRestorePrivilege	1056	wmic.exe
Token: SeShutdownPrivilege	1056	wmic.exe
Token: SeDebugPrivilege	1056	wmic.exe
Token: SeSystemEnvironmentPrivilege	1056	wmic.exe
Token: SeRemoteShutdownPrivilege	1056	wmic.exe
Token: SeUndockPrivilege	1056	wmic.exe
Token: SeManageVolumePrivilege	1056	wmic.exe
Token: 33	1056	wmic.exe
Token: 34	1056	wmic.exe
Token: 35	1056	wmic.exe
Token: SeIncreaseQuotaPrivilege	320	WMIC.exe
Token: SeSecurityPrivilege	320	WMIC.exe
Token: SeTakeOwnershipPrivilege	320	WMIC.exe
Token: SeLoadDriverPrivilege	320	WMIC.exe
Token: SeSystemProfilePrivilege	320	WMIC.exe
Token: SeSystemtimePrivilege	320	WMIC.exe
Token: SeProfSingleProcessPrivilege	320	WMIC.exe
Token: SeIncBasePriorityPrivilege	320	WMIC.exe
Token: SeCreatePagefilePrivilege	320	WMIC.exe
Token: SeBackupPrivilege	320	WMIC.exe
Token: SeRestorePrivilege	320	WMIC.exe
Token: SeShutdownPrivilege	320	WMIC.exe
Token: SeDebugPrivilege	320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	320	WMIC.exe
Token: SeRemoteShutdownPrivilege	320	WMIC.exe
Token: SeUndockPrivilege	320	WMIC.exe
Token: SeManageVolumePrivilege	320	WMIC.exe
Token: 33	320	WMIC.exe
Token: 34	320	WMIC.exe
Token: 35	320	WMIC.exe
Token: SeIncreaseQuotaPrivilege	320	WMIC.exe
Token: SeSecurityPrivilege	320	WMIC.exe
Token: SeTakeOwnershipPrivilege	320	WMIC.exe
Token: SeLoadDriverPrivilege	320	WMIC.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

2daf6321a7fb96cd0834ebd018e67dc2.execmd.execmd.exe

description	pid	process	target process
PID 1336 wrote to memory of 1056	1336	2daf6321a7fb96cd0834ebd018e67dc2.exe	wmic.exe
PID 1336 wrote to memory of 1056	1336	2daf6321a7fb96cd0834ebd018e67dc2.exe	wmic.exe
PID 1336 wrote to memory of 1056	1336	2daf6321a7fb96cd0834ebd018e67dc2.exe	wmic.exe
PID 1336 wrote to memory of 276	1336	2daf6321a7fb96cd0834ebd018e67dc2.exe	cmd.exe
PID 1336 wrote to memory of 276	1336	2daf6321a7fb96cd0834ebd018e67dc2.exe	cmd.exe
PID 1336 wrote to memory of 276	1336	2daf6321a7fb96cd0834ebd018e67dc2.exe	cmd.exe
PID 276 wrote to memory of 320	276	cmd.exe	WMIC.exe
PID 276 wrote to memory of 320	276	cmd.exe	WMIC.exe
PID 276 wrote to memory of 320	276	cmd.exe	WMIC.exe
PID 1336 wrote to memory of 1736	1336	2daf6321a7fb96cd0834ebd018e67dc2.exe	cmd.exe
PID 1336 wrote to memory of 1736	1336	2daf6321a7fb96cd0834ebd018e67dc2.exe	cmd.exe
PID 1336 wrote to memory of 1736	1336	2daf6321a7fb96cd0834ebd018e67dc2.exe	cmd.exe
PID 1736 wrote to memory of 836	1736	cmd.exe	WMIC.exe
PID 1736 wrote to memory of 836	1736	cmd.exe	WMIC.exe
PID 1736 wrote to memory of 836	1736	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\2daf6321a7fb96cd0834ebd018e67dc2.exe
"C:\Users\Admin\AppData\Local\Temp\2daf6321a7fb96cd0834ebd018e67dc2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\System32\Wbem\wmic.exe
wmic os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\system32\cmd.exe
cmd /C "wmic cpu get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
3⤵
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot
Filesize
71KB

MD5
e5e23f78017d1e6eddfc8480e1679ee4

SHA1
0667bd1b7129b105bd2c66ef6ad54c9648aec072

SHA256
4fed2f4c33a3876390d8520f184062927aca8e0ce3538127de3a2f66ea856d91

SHA512
b1260e7ba7ad6d5dd0daeabc5f7cc1fc7a2e9259092f8d70d3d9eed923ed8aa60adcce4c27e9cb20966d500ed59edaaba9570f01d6a84180f1fb83e7b5c20049

Download Submit

Analysis

Sharing