Analysis
-
max time kernel
48s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15-03-2023 02:03
Static task
static1
Behavioral task
behavioral1
Sample
5343b3beaadd15a14319e4b21dc68077.exe
Resource
win7-20230220-en
General
-
Target
5343b3beaadd15a14319e4b21dc68077.exe
-
Size
2.4MB
-
MD5
5343b3beaadd15a14319e4b21dc68077
-
SHA1
6d8b2b4c9418d882fb10ea958d5e5f281a14396b
-
SHA256
2e5260973969192f9cc166487adb128832e22f2752b176359c51264a6e5d7faa
-
SHA512
2ea3cc32b56eff42298772ac90eb26b6de98ec3c3bb183b2c1d8bbcc4c5c68877b32268b80e00ef9d4779a0c30b765f8a8bf345ef45e863b9fc2a04f5c79ab3f
-
SSDEEP
49152:GAE84ts1AF+Asb9wya6uAdaOebmDhEbhQzfnXIqWur2h7bwKPG9T9s:wwb9wya6uAdKmDhEbufnYVur2qKAs
Malware Config
Extracted
aurora
92.119.231.161:8081
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5343b3beaadd15a14319e4b21dc68077.exedescription pid process target process PID 1644 set thread context of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1164 wmic.exe Token: SeSecurityPrivilege 1164 wmic.exe Token: SeTakeOwnershipPrivilege 1164 wmic.exe Token: SeLoadDriverPrivilege 1164 wmic.exe Token: SeSystemProfilePrivilege 1164 wmic.exe Token: SeSystemtimePrivilege 1164 wmic.exe Token: SeProfSingleProcessPrivilege 1164 wmic.exe Token: SeIncBasePriorityPrivilege 1164 wmic.exe Token: SeCreatePagefilePrivilege 1164 wmic.exe Token: SeBackupPrivilege 1164 wmic.exe Token: SeRestorePrivilege 1164 wmic.exe Token: SeShutdownPrivilege 1164 wmic.exe Token: SeDebugPrivilege 1164 wmic.exe Token: SeSystemEnvironmentPrivilege 1164 wmic.exe Token: SeRemoteShutdownPrivilege 1164 wmic.exe Token: SeUndockPrivilege 1164 wmic.exe Token: SeManageVolumePrivilege 1164 wmic.exe Token: 33 1164 wmic.exe Token: 34 1164 wmic.exe Token: 35 1164 wmic.exe Token: SeIncreaseQuotaPrivilege 1164 wmic.exe Token: SeSecurityPrivilege 1164 wmic.exe Token: SeTakeOwnershipPrivilege 1164 wmic.exe Token: SeLoadDriverPrivilege 1164 wmic.exe Token: SeSystemProfilePrivilege 1164 wmic.exe Token: SeSystemtimePrivilege 1164 wmic.exe Token: SeProfSingleProcessPrivilege 1164 wmic.exe Token: SeIncBasePriorityPrivilege 1164 wmic.exe Token: SeCreatePagefilePrivilege 1164 wmic.exe Token: SeBackupPrivilege 1164 wmic.exe Token: SeRestorePrivilege 1164 wmic.exe Token: SeShutdownPrivilege 1164 wmic.exe Token: SeDebugPrivilege 1164 wmic.exe Token: SeSystemEnvironmentPrivilege 1164 wmic.exe Token: SeRemoteShutdownPrivilege 1164 wmic.exe Token: SeUndockPrivilege 1164 wmic.exe Token: SeManageVolumePrivilege 1164 wmic.exe Token: 33 1164 wmic.exe Token: 34 1164 wmic.exe Token: 35 1164 wmic.exe Token: SeIncreaseQuotaPrivilege 364 WMIC.exe Token: SeSecurityPrivilege 364 WMIC.exe Token: SeTakeOwnershipPrivilege 364 WMIC.exe Token: SeLoadDriverPrivilege 364 WMIC.exe Token: SeSystemProfilePrivilege 364 WMIC.exe Token: SeSystemtimePrivilege 364 WMIC.exe Token: SeProfSingleProcessPrivilege 364 WMIC.exe Token: SeIncBasePriorityPrivilege 364 WMIC.exe Token: SeCreatePagefilePrivilege 364 WMIC.exe Token: SeBackupPrivilege 364 WMIC.exe Token: SeRestorePrivilege 364 WMIC.exe Token: SeShutdownPrivilege 364 WMIC.exe Token: SeDebugPrivilege 364 WMIC.exe Token: SeSystemEnvironmentPrivilege 364 WMIC.exe Token: SeRemoteShutdownPrivilege 364 WMIC.exe Token: SeUndockPrivilege 364 WMIC.exe Token: SeManageVolumePrivilege 364 WMIC.exe Token: 33 364 WMIC.exe Token: 34 364 WMIC.exe Token: 35 364 WMIC.exe Token: SeIncreaseQuotaPrivilege 364 WMIC.exe Token: SeSecurityPrivilege 364 WMIC.exe Token: SeTakeOwnershipPrivilege 364 WMIC.exe Token: SeLoadDriverPrivilege 364 WMIC.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
5343b3beaadd15a14319e4b21dc68077.exe5343b3beaadd15a14319e4b21dc68077.execmd.execmd.exedescription pid process target process PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1644 wrote to memory of 1388 1644 5343b3beaadd15a14319e4b21dc68077.exe 5343b3beaadd15a14319e4b21dc68077.exe PID 1388 wrote to memory of 1164 1388 5343b3beaadd15a14319e4b21dc68077.exe wmic.exe PID 1388 wrote to memory of 1164 1388 5343b3beaadd15a14319e4b21dc68077.exe wmic.exe PID 1388 wrote to memory of 1164 1388 5343b3beaadd15a14319e4b21dc68077.exe wmic.exe PID 1388 wrote to memory of 1164 1388 5343b3beaadd15a14319e4b21dc68077.exe wmic.exe PID 1388 wrote to memory of 836 1388 5343b3beaadd15a14319e4b21dc68077.exe cmd.exe PID 1388 wrote to memory of 836 1388 5343b3beaadd15a14319e4b21dc68077.exe cmd.exe PID 1388 wrote to memory of 836 1388 5343b3beaadd15a14319e4b21dc68077.exe cmd.exe PID 1388 wrote to memory of 836 1388 5343b3beaadd15a14319e4b21dc68077.exe cmd.exe PID 836 wrote to memory of 364 836 cmd.exe WMIC.exe PID 836 wrote to memory of 364 836 cmd.exe WMIC.exe PID 836 wrote to memory of 364 836 cmd.exe WMIC.exe PID 836 wrote to memory of 364 836 cmd.exe WMIC.exe PID 1388 wrote to memory of 1656 1388 5343b3beaadd15a14319e4b21dc68077.exe cmd.exe PID 1388 wrote to memory of 1656 1388 5343b3beaadd15a14319e4b21dc68077.exe cmd.exe PID 1388 wrote to memory of 1656 1388 5343b3beaadd15a14319e4b21dc68077.exe cmd.exe PID 1388 wrote to memory of 1656 1388 5343b3beaadd15a14319e4b21dc68077.exe cmd.exe PID 1656 wrote to memory of 2012 1656 cmd.exe WMIC.exe PID 1656 wrote to memory of 2012 1656 cmd.exe WMIC.exe PID 1656 wrote to memory of 2012 1656 cmd.exe WMIC.exe PID 1656 wrote to memory of 2012 1656 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5343b3beaadd15a14319e4b21dc68077.exe"C:\Users\Admin\AppData\Local\Temp\5343b3beaadd15a14319e4b21dc68077.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5343b3beaadd15a14319e4b21dc68077.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmotFilesize
71KB
MD52beb695add0546f6a18496aae58b2558
SHA11fd818202a94825c56ad7a7793bea87c6f02960e
SHA256132cb7037ada7d8563c5b8cf64796ed22b0fbc1ccefbbbf5faa3c18545b289ed
SHA512e80fa42ab27afa16e0f6f72639077be7da3e73f7c7b4cecbe0d24637ee76334de77a2b61e7c3afab4e3750e53a93baa68d3cdb9c1eb55fb9a5d580cff94f21f2
-
memory/1388-66-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-108-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-65-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-76-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-75-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-61-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-60-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-62-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-63-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1388-74-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-73-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-64-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-68-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-70-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-71-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1388-72-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1644-56-0x0000000000360000-0x000000000036C000-memory.dmpFilesize
48KB
-
memory/1644-57-0x0000000005040000-0x0000000005080000-memory.dmpFilesize
256KB
-
memory/1644-59-0x000000000CAA0000-0x000000000CDA4000-memory.dmpFilesize
3.0MB
-
memory/1644-58-0x000000000A8A0000-0x000000000AAA4000-memory.dmpFilesize
2.0MB
-
memory/1644-55-0x0000000005040000-0x0000000005080000-memory.dmpFilesize
256KB
-
memory/1644-54-0x0000000000D30000-0x0000000000F9C000-memory.dmpFilesize
2.4MB