Analysis
-
max time kernel
76s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-03-2023 12:39
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
3.0MB
-
MD5
a8a106555b9e1f92569d623c66ee8c12
-
SHA1
a5080c26b5f5911c10d80654c84239a226fc75d1
-
SHA256
84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
-
SHA512
9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
SSDEEP
49152:3WjN903V68U3f1uXAlL/EUSiITRf+EGg7dyvUCUDaB5+Tc6k1HFm:3IrIVbUYiLs4vUCU5T0w
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2720 wmic.exe Token: SeSecurityPrivilege 2720 wmic.exe Token: SeTakeOwnershipPrivilege 2720 wmic.exe Token: SeLoadDriverPrivilege 2720 wmic.exe Token: SeSystemProfilePrivilege 2720 wmic.exe Token: SeSystemtimePrivilege 2720 wmic.exe Token: SeProfSingleProcessPrivilege 2720 wmic.exe Token: SeIncBasePriorityPrivilege 2720 wmic.exe Token: SeCreatePagefilePrivilege 2720 wmic.exe Token: SeBackupPrivilege 2720 wmic.exe Token: SeRestorePrivilege 2720 wmic.exe Token: SeShutdownPrivilege 2720 wmic.exe Token: SeDebugPrivilege 2720 wmic.exe Token: SeSystemEnvironmentPrivilege 2720 wmic.exe Token: SeRemoteShutdownPrivilege 2720 wmic.exe Token: SeUndockPrivilege 2720 wmic.exe Token: SeManageVolumePrivilege 2720 wmic.exe Token: 33 2720 wmic.exe Token: 34 2720 wmic.exe Token: 35 2720 wmic.exe Token: 36 2720 wmic.exe Token: SeIncreaseQuotaPrivilege 2720 wmic.exe Token: SeSecurityPrivilege 2720 wmic.exe Token: SeTakeOwnershipPrivilege 2720 wmic.exe Token: SeLoadDriverPrivilege 2720 wmic.exe Token: SeSystemProfilePrivilege 2720 wmic.exe Token: SeSystemtimePrivilege 2720 wmic.exe Token: SeProfSingleProcessPrivilege 2720 wmic.exe Token: SeIncBasePriorityPrivilege 2720 wmic.exe Token: SeCreatePagefilePrivilege 2720 wmic.exe Token: SeBackupPrivilege 2720 wmic.exe Token: SeRestorePrivilege 2720 wmic.exe Token: SeShutdownPrivilege 2720 wmic.exe Token: SeDebugPrivilege 2720 wmic.exe Token: SeSystemEnvironmentPrivilege 2720 wmic.exe Token: SeRemoteShutdownPrivilege 2720 wmic.exe Token: SeUndockPrivilege 2720 wmic.exe Token: SeManageVolumePrivilege 2720 wmic.exe Token: 33 2720 wmic.exe Token: 34 2720 wmic.exe Token: 35 2720 wmic.exe Token: 36 2720 wmic.exe Token: SeIncreaseQuotaPrivilege 1180 WMIC.exe Token: SeSecurityPrivilege 1180 WMIC.exe Token: SeTakeOwnershipPrivilege 1180 WMIC.exe Token: SeLoadDriverPrivilege 1180 WMIC.exe Token: SeSystemProfilePrivilege 1180 WMIC.exe Token: SeSystemtimePrivilege 1180 WMIC.exe Token: SeProfSingleProcessPrivilege 1180 WMIC.exe Token: SeIncBasePriorityPrivilege 1180 WMIC.exe Token: SeCreatePagefilePrivilege 1180 WMIC.exe Token: SeBackupPrivilege 1180 WMIC.exe Token: SeRestorePrivilege 1180 WMIC.exe Token: SeShutdownPrivilege 1180 WMIC.exe Token: SeDebugPrivilege 1180 WMIC.exe Token: SeSystemEnvironmentPrivilege 1180 WMIC.exe Token: SeRemoteShutdownPrivilege 1180 WMIC.exe Token: SeUndockPrivilege 1180 WMIC.exe Token: SeManageVolumePrivilege 1180 WMIC.exe Token: 33 1180 WMIC.exe Token: 34 1180 WMIC.exe Token: 35 1180 WMIC.exe Token: 36 1180 WMIC.exe Token: SeIncreaseQuotaPrivilege 1180 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
file.execmd.execmd.exedescription pid process target process PID 3916 wrote to memory of 2720 3916 file.exe wmic.exe PID 3916 wrote to memory of 2720 3916 file.exe wmic.exe PID 3916 wrote to memory of 2720 3916 file.exe wmic.exe PID 3916 wrote to memory of 5020 3916 file.exe cmd.exe PID 3916 wrote to memory of 5020 3916 file.exe cmd.exe PID 3916 wrote to memory of 5020 3916 file.exe cmd.exe PID 5020 wrote to memory of 1180 5020 cmd.exe WMIC.exe PID 5020 wrote to memory of 1180 5020 cmd.exe WMIC.exe PID 5020 wrote to memory of 1180 5020 cmd.exe WMIC.exe PID 3916 wrote to memory of 4488 3916 file.exe cmd.exe PID 3916 wrote to memory of 4488 3916 file.exe cmd.exe PID 3916 wrote to memory of 4488 3916 file.exe cmd.exe PID 4488 wrote to memory of 2596 4488 cmd.exe WMIC.exe PID 4488 wrote to memory of 2596 4488 cmd.exe WMIC.exe PID 4488 wrote to memory of 2596 4488 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaLFilesize
2KB
MD51d65ace99a200cf0ac042936baf39f68
SHA1acd9cd136a2b583c7d89dcbeffad15316921b145
SHA25659f9c188335405db46c008bcd919293d3ea2e549db72d9f0f83ef34195809bc6
SHA512bfc0c01bdca82c7d5ff2210d59049a65930500eaf40b26c2aa6d6149b971b5db63edc12ee5a0ee0ccd8a33bcfcb1063eb1bcf1bbc63788976baee47224bdf486
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
71KB
MD5fb2e05653c3115d89013daa5132f08e0
SHA18ad3d1f4c1652c1e173d3201faf9fdd22b229351
SHA256895ce9cfa9bd4ce960723e7adf0aba7eefff4c8cd5e46cad13cb791a39665077
SHA512ca9b7fac566026fa87872d3fdfa32a5a571613b8d9cd4364e1b05d0682d52844c9d1a28c292d6d129d506a627a6cef2a0e6329f8c2ab28cd4388789f48399238