07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165

General

Target

07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe
Size

3.0MB
MD5

af4268c094f2a9c6e6a85f8626b9a5c7
SHA1

7d6b6083ec9081f52517cc7952dfb0c1c416e395
SHA256

07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165
SHA512

2ab2d4771841ebbeb195d21697c1708db985ae821a7ed3e2bb050c5759fbdb1e7784354fa5611e377a603a6db437e90a7258ecfcbea7703e584330b91eacac68
SSDEEP

49152:y2sQ8R/u6S/gPV4PW/vlLr8EdiITRf+EGg7dH1zaSo5hTk6k1qFG:yfQM/fSoPFNLQg1WT5Q

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1268	wmic.exe
Token: SeSecurityPrivilege	1268	wmic.exe
Token: SeTakeOwnershipPrivilege	1268	wmic.exe
Token: SeLoadDriverPrivilege	1268	wmic.exe
Token: SeSystemProfilePrivilege	1268	wmic.exe
Token: SeSystemtimePrivilege	1268	wmic.exe
Token: SeProfSingleProcessPrivilege	1268	wmic.exe
Token: SeIncBasePriorityPrivilege	1268	wmic.exe
Token: SeCreatePagefilePrivilege	1268	wmic.exe
Token: SeBackupPrivilege	1268	wmic.exe
Token: SeRestorePrivilege	1268	wmic.exe
Token: SeShutdownPrivilege	1268	wmic.exe
Token: SeDebugPrivilege	1268	wmic.exe
Token: SeSystemEnvironmentPrivilege	1268	wmic.exe
Token: SeRemoteShutdownPrivilege	1268	wmic.exe
Token: SeUndockPrivilege	1268	wmic.exe
Token: SeManageVolumePrivilege	1268	wmic.exe
Token: 33	1268	wmic.exe
Token: 34	1268	wmic.exe
Token: 35	1268	wmic.exe
Token: SeIncreaseQuotaPrivilege	1268	wmic.exe
Token: SeSecurityPrivilege	1268	wmic.exe
Token: SeTakeOwnershipPrivilege	1268	wmic.exe
Token: SeLoadDriverPrivilege	1268	wmic.exe
Token: SeSystemProfilePrivilege	1268	wmic.exe
Token: SeSystemtimePrivilege	1268	wmic.exe
Token: SeProfSingleProcessPrivilege	1268	wmic.exe
Token: SeIncBasePriorityPrivilege	1268	wmic.exe
Token: SeCreatePagefilePrivilege	1268	wmic.exe
Token: SeBackupPrivilege	1268	wmic.exe
Token: SeRestorePrivilege	1268	wmic.exe
Token: SeShutdownPrivilege	1268	wmic.exe
Token: SeDebugPrivilege	1268	wmic.exe
Token: SeSystemEnvironmentPrivilege	1268	wmic.exe
Token: SeRemoteShutdownPrivilege	1268	wmic.exe
Token: SeUndockPrivilege	1268	wmic.exe
Token: SeManageVolumePrivilege	1268	wmic.exe
Token: 33	1268	wmic.exe
Token: 34	1268	wmic.exe
Token: 35	1268	wmic.exe
Token: SeIncreaseQuotaPrivilege	1468	WMIC.exe
Token: SeSecurityPrivilege	1468	WMIC.exe
Token: SeTakeOwnershipPrivilege	1468	WMIC.exe
Token: SeLoadDriverPrivilege	1468	WMIC.exe
Token: SeSystemProfilePrivilege	1468	WMIC.exe
Token: SeSystemtimePrivilege	1468	WMIC.exe
Token: SeProfSingleProcessPrivilege	1468	WMIC.exe
Token: SeIncBasePriorityPrivilege	1468	WMIC.exe
Token: SeCreatePagefilePrivilege	1468	WMIC.exe
Token: SeBackupPrivilege	1468	WMIC.exe
Token: SeRestorePrivilege	1468	WMIC.exe
Token: SeShutdownPrivilege	1468	WMIC.exe
Token: SeDebugPrivilege	1468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1468	WMIC.exe
Token: SeRemoteShutdownPrivilege	1468	WMIC.exe
Token: SeUndockPrivilege	1468	WMIC.exe
Token: SeManageVolumePrivilege	1468	WMIC.exe
Token: 33	1468	WMIC.exe
Token: 34	1468	WMIC.exe
Token: 35	1468	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1468	WMIC.exe
Token: SeSecurityPrivilege	1468	WMIC.exe
Token: SeTakeOwnershipPrivilege	1468	WMIC.exe
Token: SeLoadDriverPrivilege	1468	WMIC.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.execmd.execmd.exe

description	pid	process	target process
PID 1244 wrote to memory of 1268	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	wmic.exe
PID 1244 wrote to memory of 1268	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	wmic.exe
PID 1244 wrote to memory of 1268	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	wmic.exe
PID 1244 wrote to memory of 1268	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	wmic.exe
PID 1244 wrote to memory of 1672	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	cmd.exe
PID 1244 wrote to memory of 1672	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	cmd.exe
PID 1244 wrote to memory of 1672	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	cmd.exe
PID 1244 wrote to memory of 1672	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	cmd.exe
PID 1672 wrote to memory of 1468	1672	cmd.exe	WMIC.exe
PID 1672 wrote to memory of 1468	1672	cmd.exe	WMIC.exe
PID 1672 wrote to memory of 1468	1672	cmd.exe	WMIC.exe
PID 1672 wrote to memory of 1468	1672	cmd.exe	WMIC.exe
PID 1244 wrote to memory of 636	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	cmd.exe
PID 1244 wrote to memory of 636	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	cmd.exe
PID 1244 wrote to memory of 636	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	cmd.exe
PID 1244 wrote to memory of 636	1244	07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe	cmd.exe
PID 636 wrote to memory of 864	636	cmd.exe	WMIC.exe
PID 636 wrote to memory of 864	636	cmd.exe	WMIC.exe
PID 636 wrote to memory of 864	636	cmd.exe	WMIC.exe
PID 636 wrote to memory of 864	636	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe
"C:\Users\Admin\AppData\Local\Temp\07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
3⤵
PID:864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot
Filesize
71KB

MD5
e5e23f78017d1e6eddfc8480e1679ee4

SHA1
0667bd1b7129b105bd2c66ef6ad54c9648aec072

SHA256
4fed2f4c33a3876390d8520f184062927aca8e0ce3538127de3a2f66ea856d91

SHA512
b1260e7ba7ad6d5dd0daeabc5f7cc1fc7a2e9259092f8d70d3d9eed923ed8aa60adcce4c27e9cb20966d500ed59edaaba9570f01d6a84180f1fb83e7b5c20049

Download Submit

Analysis

Sharing