48392e0c0969580a9eaa9fa882b543b319ea08e6492d3a6819bc0c5b64d78396

General

Target

file.exe
Size

4.4MB
MD5

15d1bdb5f6e3267b936b401485897479
SHA1

f9f1c88d6d1e929a42c15dc3c0c0afefbe42544d
SHA256

48392e0c0969580a9eaa9fa882b543b319ea08e6492d3a6819bc0c5b64d78396
SHA512

e941ad9a9fddf0dd4a0d3d0bd2b02f55e2a3361de6ce9bcc674e4bb33d82c59a4519e5cf2d90e2d422ab3f860247a8c78abd715b3ceaecbc5b013be0e42812ac
SSDEEP

49152:C2sQ8R/u6S/gPV4PW/vlLr8EdiITRf+EGg7dH1CaSo5qTk6k1lFAw8A7/eFwjDr9:CfQM/fSoPFNLQg1UTOWw8a0cDAOn

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1868	wmic.exe
Token: SeSecurityPrivilege	1868	wmic.exe
Token: SeTakeOwnershipPrivilege	1868	wmic.exe
Token: SeLoadDriverPrivilege	1868	wmic.exe
Token: SeSystemProfilePrivilege	1868	wmic.exe
Token: SeSystemtimePrivilege	1868	wmic.exe
Token: SeProfSingleProcessPrivilege	1868	wmic.exe
Token: SeIncBasePriorityPrivilege	1868	wmic.exe
Token: SeCreatePagefilePrivilege	1868	wmic.exe
Token: SeBackupPrivilege	1868	wmic.exe
Token: SeRestorePrivilege	1868	wmic.exe
Token: SeShutdownPrivilege	1868	wmic.exe
Token: SeDebugPrivilege	1868	wmic.exe
Token: SeSystemEnvironmentPrivilege	1868	wmic.exe
Token: SeRemoteShutdownPrivilege	1868	wmic.exe
Token: SeUndockPrivilege	1868	wmic.exe
Token: SeManageVolumePrivilege	1868	wmic.exe
Token: 33	1868	wmic.exe
Token: 34	1868	wmic.exe
Token: 35	1868	wmic.exe
Token: 36	1868	wmic.exe
Token: SeIncreaseQuotaPrivilege	1868	wmic.exe
Token: SeSecurityPrivilege	1868	wmic.exe
Token: SeTakeOwnershipPrivilege	1868	wmic.exe
Token: SeLoadDriverPrivilege	1868	wmic.exe
Token: SeSystemProfilePrivilege	1868	wmic.exe
Token: SeSystemtimePrivilege	1868	wmic.exe
Token: SeProfSingleProcessPrivilege	1868	wmic.exe
Token: SeIncBasePriorityPrivilege	1868	wmic.exe
Token: SeCreatePagefilePrivilege	1868	wmic.exe
Token: SeBackupPrivilege	1868	wmic.exe
Token: SeRestorePrivilege	1868	wmic.exe
Token: SeShutdownPrivilege	1868	wmic.exe
Token: SeDebugPrivilege	1868	wmic.exe
Token: SeSystemEnvironmentPrivilege	1868	wmic.exe
Token: SeRemoteShutdownPrivilege	1868	wmic.exe
Token: SeUndockPrivilege	1868	wmic.exe
Token: SeManageVolumePrivilege	1868	wmic.exe
Token: 33	1868	wmic.exe
Token: 34	1868	wmic.exe
Token: 35	1868	wmic.exe
Token: 36	1868	wmic.exe
Token: SeIncreaseQuotaPrivilege	3720	WMIC.exe
Token: SeSecurityPrivilege	3720	WMIC.exe
Token: SeTakeOwnershipPrivilege	3720	WMIC.exe
Token: SeLoadDriverPrivilege	3720	WMIC.exe
Token: SeSystemProfilePrivilege	3720	WMIC.exe
Token: SeSystemtimePrivilege	3720	WMIC.exe
Token: SeProfSingleProcessPrivilege	3720	WMIC.exe
Token: SeIncBasePriorityPrivilege	3720	WMIC.exe
Token: SeCreatePagefilePrivilege	3720	WMIC.exe
Token: SeBackupPrivilege	3720	WMIC.exe
Token: SeRestorePrivilege	3720	WMIC.exe
Token: SeShutdownPrivilege	3720	WMIC.exe
Token: SeDebugPrivilege	3720	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3720	WMIC.exe
Token: SeRemoteShutdownPrivilege	3720	WMIC.exe
Token: SeUndockPrivilege	3720	WMIC.exe
Token: SeManageVolumePrivilege	3720	WMIC.exe
Token: 33	3720	WMIC.exe
Token: 34	3720	WMIC.exe
Token: 35	3720	WMIC.exe
Token: 36	3720	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3720	WMIC.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

file.execmd.execmd.exe

description	pid	process	target process
PID 4696 wrote to memory of 1868	4696	file.exe	wmic.exe
PID 4696 wrote to memory of 1868	4696	file.exe	wmic.exe
PID 4696 wrote to memory of 1868	4696	file.exe	wmic.exe
PID 4696 wrote to memory of 3808	4696	file.exe	cmd.exe
PID 4696 wrote to memory of 3808	4696	file.exe	cmd.exe
PID 4696 wrote to memory of 3808	4696	file.exe	cmd.exe
PID 3808 wrote to memory of 3720	3808	cmd.exe	WMIC.exe
PID 3808 wrote to memory of 3720	3808	cmd.exe	WMIC.exe
PID 3808 wrote to memory of 3720	3808	cmd.exe	WMIC.exe
PID 4696 wrote to memory of 1796	4696	file.exe	cmd.exe
PID 4696 wrote to memory of 1796	4696	file.exe	cmd.exe
PID 4696 wrote to memory of 1796	4696	file.exe	cmd.exe
PID 1796 wrote to memory of 4200	1796	cmd.exe	WMIC.exe
PID 1796 wrote to memory of 4200	1796	cmd.exe	WMIC.exe
PID 1796 wrote to memory of 4200	1796	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:3808

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
3⤵
PID:4200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL
Filesize
2KB

MD5
1d65ace99a200cf0ac042936baf39f68

SHA1
acd9cd136a2b583c7d89dcbeffad15316921b145

SHA256
59f9c188335405db46c008bcd919293d3ea2e549db72d9f0f83ef34195809bc6

SHA512
bfc0c01bdca82c7d5ff2210d59049a65930500eaf40b26c2aa6d6149b971b5db63edc12ee5a0ee0ccd8a33bcfcb1063eb1bcf1bbc63788976baee47224bdf486

Download Submit
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
Filesize
71KB

MD5
fb2e05653c3115d89013daa5132f08e0

SHA1
8ad3d1f4c1652c1e173d3201faf9fdd22b229351

SHA256
895ce9cfa9bd4ce960723e7adf0aba7eefff4c8cd5e46cad13cb791a39665077

SHA512
ca9b7fac566026fa87872d3fdfa32a5a571613b8d9cd4364e1b05d0682d52844c9d1a28c292d6d129d506a627a6cef2a0e6329f8c2ab28cd4388789f48399238

Download Submit

Analysis

Sharing