48392e0c0969580a9eaa9fa882b543b319ea08e6492d3a6819bc0c5b64d78396

General

Target

file.exe
Size

4.4MB
MD5

15d1bdb5f6e3267b936b401485897479
SHA1

f9f1c88d6d1e929a42c15dc3c0c0afefbe42544d
SHA256

48392e0c0969580a9eaa9fa882b543b319ea08e6492d3a6819bc0c5b64d78396
SHA512

e941ad9a9fddf0dd4a0d3d0bd2b02f55e2a3361de6ce9bcc674e4bb33d82c59a4519e5cf2d90e2d422ab3f860247a8c78abd715b3ceaecbc5b013be0e42812ac
SSDEEP

49152:C2sQ8R/u6S/gPV4PW/vlLr8EdiITRf+EGg7dH1CaSo5qTk6k1lFAw8A7/eFwjDr9:CfQM/fSoPFNLQg1UTOWw8a0cDAOn

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1232	wmic.exe
Token: SeSecurityPrivilege	1232	wmic.exe
Token: SeTakeOwnershipPrivilege	1232	wmic.exe
Token: SeLoadDriverPrivilege	1232	wmic.exe
Token: SeSystemProfilePrivilege	1232	wmic.exe
Token: SeSystemtimePrivilege	1232	wmic.exe
Token: SeProfSingleProcessPrivilege	1232	wmic.exe
Token: SeIncBasePriorityPrivilege	1232	wmic.exe
Token: SeCreatePagefilePrivilege	1232	wmic.exe
Token: SeBackupPrivilege	1232	wmic.exe
Token: SeRestorePrivilege	1232	wmic.exe
Token: SeShutdownPrivilege	1232	wmic.exe
Token: SeDebugPrivilege	1232	wmic.exe
Token: SeSystemEnvironmentPrivilege	1232	wmic.exe
Token: SeRemoteShutdownPrivilege	1232	wmic.exe
Token: SeUndockPrivilege	1232	wmic.exe
Token: SeManageVolumePrivilege	1232	wmic.exe
Token: 33	1232	wmic.exe
Token: 34	1232	wmic.exe
Token: 35	1232	wmic.exe
Token: SeIncreaseQuotaPrivilege	1232	wmic.exe
Token: SeSecurityPrivilege	1232	wmic.exe
Token: SeTakeOwnershipPrivilege	1232	wmic.exe
Token: SeLoadDriverPrivilege	1232	wmic.exe
Token: SeSystemProfilePrivilege	1232	wmic.exe
Token: SeSystemtimePrivilege	1232	wmic.exe
Token: SeProfSingleProcessPrivilege	1232	wmic.exe
Token: SeIncBasePriorityPrivilege	1232	wmic.exe
Token: SeCreatePagefilePrivilege	1232	wmic.exe
Token: SeBackupPrivilege	1232	wmic.exe
Token: SeRestorePrivilege	1232	wmic.exe
Token: SeShutdownPrivilege	1232	wmic.exe
Token: SeDebugPrivilege	1232	wmic.exe
Token: SeSystemEnvironmentPrivilege	1232	wmic.exe
Token: SeRemoteShutdownPrivilege	1232	wmic.exe
Token: SeUndockPrivilege	1232	wmic.exe
Token: SeManageVolumePrivilege	1232	wmic.exe
Token: 33	1232	wmic.exe
Token: 34	1232	wmic.exe
Token: 35	1232	wmic.exe
Token: SeIncreaseQuotaPrivilege	596	WMIC.exe
Token: SeSecurityPrivilege	596	WMIC.exe
Token: SeTakeOwnershipPrivilege	596	WMIC.exe
Token: SeLoadDriverPrivilege	596	WMIC.exe
Token: SeSystemProfilePrivilege	596	WMIC.exe
Token: SeSystemtimePrivilege	596	WMIC.exe
Token: SeProfSingleProcessPrivilege	596	WMIC.exe
Token: SeIncBasePriorityPrivilege	596	WMIC.exe
Token: SeCreatePagefilePrivilege	596	WMIC.exe
Token: SeBackupPrivilege	596	WMIC.exe
Token: SeRestorePrivilege	596	WMIC.exe
Token: SeShutdownPrivilege	596	WMIC.exe
Token: SeDebugPrivilege	596	WMIC.exe
Token: SeSystemEnvironmentPrivilege	596	WMIC.exe
Token: SeRemoteShutdownPrivilege	596	WMIC.exe
Token: SeUndockPrivilege	596	WMIC.exe
Token: SeManageVolumePrivilege	596	WMIC.exe
Token: 33	596	WMIC.exe
Token: 34	596	WMIC.exe
Token: 35	596	WMIC.exe
Token: SeIncreaseQuotaPrivilege	596	WMIC.exe
Token: SeSecurityPrivilege	596	WMIC.exe
Token: SeTakeOwnershipPrivilege	596	WMIC.exe
Token: SeLoadDriverPrivilege	596	WMIC.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

file.execmd.execmd.exe

description	pid	process	target process
PID 1648 wrote to memory of 1232	1648	file.exe	wmic.exe
PID 1648 wrote to memory of 1232	1648	file.exe	wmic.exe
PID 1648 wrote to memory of 1232	1648	file.exe	wmic.exe
PID 1648 wrote to memory of 1232	1648	file.exe	wmic.exe
PID 1648 wrote to memory of 1660	1648	file.exe	cmd.exe
PID 1648 wrote to memory of 1660	1648	file.exe	cmd.exe
PID 1648 wrote to memory of 1660	1648	file.exe	cmd.exe
PID 1648 wrote to memory of 1660	1648	file.exe	cmd.exe
PID 1660 wrote to memory of 596	1660	cmd.exe	WMIC.exe
PID 1660 wrote to memory of 596	1660	cmd.exe	WMIC.exe
PID 1660 wrote to memory of 596	1660	cmd.exe	WMIC.exe
PID 1660 wrote to memory of 596	1660	cmd.exe	WMIC.exe
PID 1648 wrote to memory of 1740	1648	file.exe	cmd.exe
PID 1648 wrote to memory of 1740	1648	file.exe	cmd.exe
PID 1648 wrote to memory of 1740	1648	file.exe	cmd.exe
PID 1648 wrote to memory of 1740	1648	file.exe	cmd.exe
PID 1740 wrote to memory of 1164	1740	cmd.exe	WMIC.exe
PID 1740 wrote to memory of 1164	1740	cmd.exe	WMIC.exe
PID 1740 wrote to memory of 1164	1740	cmd.exe	WMIC.exe
PID 1740 wrote to memory of 1164	1740	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:596
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic cpu get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot

Filesize
71KB

MD5
2beb695add0546f6a18496aae58b2558

SHA1
1fd818202a94825c56ad7a7793bea87c6f02960e

SHA256
132cb7037ada7d8563c5b8cf64796ed22b0fbc1ccefbbbf5faa3c18545b289ed

SHA512
e80fa42ab27afa16e0f6f72639077be7da3e73f7c7b4cecbe0d24637ee76334de77a2b61e7c3afab4e3750e53a93baa68d3cdb9c1eb55fb9a5d580cff94f21f2

Download Submit

Analysis

Sharing