Overview

overview

10

Static

static

10

uni2.exe

windows7-x64

7

uni2.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    103s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-03-2023 03:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    uni2.exe

  • Size

    3.0MB

  • MD5

    7b7f66624ef0b602dc8b5cf5ab0e0cc7

  • SHA1

    7ce5ff0bc6ed6160b34d110f58c4e3b3131b6471

  • SHA256

    417aee1f9b38131b40df67ca5ade203e6e45fb3b2928ba209ef2afacc3d6d8fe

  • SHA512

    622a202c7ad573c7f6d98905b7b4edeb8e0084d069e3943fbfc03046df5f19fe48e48aeda4f8c396a8a79fa85f136720cc3312c8a8cb6564a9928a76fe1f4e8d

  • SSDEEP

    49152:n2F3dmZsmanH2CXOwjygvaBsLFA8pHht8k1r:aPmEjpLO8pZ

Score
7/10
spywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\uni2.exe
    "C:\Users\Admin\AppData\Local\Temp\uni2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5108
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1412
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic path win32_VideoController get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic path win32_VideoController get name
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2244
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic cpu get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic cpu get name
        3⤵
          PID:2176

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL
      Filesize

      2KB

      MD5

      1d65ace99a200cf0ac042936baf39f68

      SHA1

      acd9cd136a2b583c7d89dcbeffad15316921b145

      SHA256

      59f9c188335405db46c008bcd919293d3ea2e549db72d9f0f83ef34195809bc6

      SHA512

      bfc0c01bdca82c7d5ff2210d59049a65930500eaf40b26c2aa6d6149b971b5db63edc12ee5a0ee0ccd8a33bcfcb1063eb1bcf1bbc63788976baee47224bdf486

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
      Filesize

      71KB

      MD5

      fb2e05653c3115d89013daa5132f08e0

      SHA1

      8ad3d1f4c1652c1e173d3201faf9fdd22b229351

      SHA256

      895ce9cfa9bd4ce960723e7adf0aba7eefff4c8cd5e46cad13cb791a39665077

      SHA512

      ca9b7fac566026fa87872d3fdfa32a5a571613b8d9cd4364e1b05d0682d52844c9d1a28c292d6d129d506a627a6cef2a0e6329f8c2ab28cd4388789f48399238

      Download Submit