Analysis
- max time kernel
76s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
16/03/2023, 17:03
Behavioral task
behavioral1
Sample
0x000600000002316e-145.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
General
- Target 0x000600000002316e-145.exe
- Size 3.0MB
- Sample230316-vktf5aca27
- SHA256 a7e18f8334187302d07b411518c03f7b472b7ba17751e6f5d239541105aedd36
- MD5 a22f4f4fd882dc77ae4adcf180d34f1a
- SHA1 b630ffa68e2fe05f60dec473368354e8c07a53c5
- SHA512 1f1e5cb83dc8b95630702faea3107ffd6929dcbad1b30b5b7d77d5b7284d883a60fac0d802e7b9b624b45ee0362af08d5d8426b5d010e0f71cc1bd01c46a329e
- SSDEEP 49152:KGX3o2lDES/ed3+XMxfE36PalsLFA8ppBnVIk1o:goELE+LO8pTA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1728 wmic.exe Token: SeSecurityPrivilege 1728 wmic.exe Token: SeTakeOwnershipPrivilege 1728 wmic.exe Token: SeLoadDriverPrivilege 1728 wmic.exe Token: SeSystemProfilePrivilege 1728 wmic.exe Token: SeSystemtimePrivilege 1728 wmic.exe Token: SeProfSingleProcessPrivilege 1728 wmic.exe Token: SeIncBasePriorityPrivilege 1728 wmic.exe Token: SeCreatePagefilePrivilege 1728 wmic.exe Token: SeBackupPrivilege 1728 wmic.exe Token: SeRestorePrivilege 1728 wmic.exe Token: SeShutdownPrivilege 1728 wmic.exe Token: SeDebugPrivilege 1728 wmic.exe Token: SeSystemEnvironmentPrivilege 1728 wmic.exe Token: SeRemoteShutdownPrivilege 1728 wmic.exe Token: SeUndockPrivilege 1728 wmic.exe Token: SeManageVolumePrivilege 1728 wmic.exe Token: 33 1728 wmic.exe Token: 34 1728 wmic.exe Token: 35 1728 wmic.exe Token: 36 1728 wmic.exe Token: SeIncreaseQuotaPrivilege 1728 wmic.exe Token: SeSecurityPrivilege 1728 wmic.exe Token: SeTakeOwnershipPrivilege 1728 wmic.exe Token: SeLoadDriverPrivilege 1728 wmic.exe Token: SeSystemProfilePrivilege 1728 wmic.exe Token: SeSystemtimePrivilege 1728 wmic.exe Token: SeProfSingleProcessPrivilege 1728 wmic.exe Token: SeIncBasePriorityPrivilege 1728 wmic.exe Token: SeCreatePagefilePrivilege 1728 wmic.exe Token: SeBackupPrivilege 1728 wmic.exe Token: SeRestorePrivilege 1728 wmic.exe Token: SeShutdownPrivilege 1728 wmic.exe Token: SeDebugPrivilege 1728 wmic.exe Token: SeSystemEnvironmentPrivilege 1728 wmic.exe Token: SeRemoteShutdownPrivilege 1728 wmic.exe Token: SeUndockPrivilege 1728 wmic.exe Token: SeManageVolumePrivilege 1728 wmic.exe Token: 33 1728 wmic.exe Token: 34 1728 wmic.exe Token: 35 1728 wmic.exe Token: 36 1728 wmic.exe Token: SeIncreaseQuotaPrivilege 3456 WMIC.exe Token: SeSecurityPrivilege 3456 WMIC.exe Token: SeTakeOwnershipPrivilege 3456 WMIC.exe Token: SeLoadDriverPrivilege 3456 WMIC.exe Token: SeSystemProfilePrivilege 3456 WMIC.exe Token: SeSystemtimePrivilege 3456 WMIC.exe Token: SeProfSingleProcessPrivilege 3456 WMIC.exe Token: SeIncBasePriorityPrivilege 3456 WMIC.exe Token: SeCreatePagefilePrivilege 3456 WMIC.exe Token: SeBackupPrivilege 3456 WMIC.exe Token: SeRestorePrivilege 3456 WMIC.exe Token: SeShutdownPrivilege 3456 WMIC.exe Token: SeDebugPrivilege 3456 WMIC.exe Token: SeSystemEnvironmentPrivilege 3456 WMIC.exe Token: SeRemoteShutdownPrivilege 3456 WMIC.exe Token: SeUndockPrivilege 3456 WMIC.exe Token: SeManageVolumePrivilege 3456 WMIC.exe Token: 33 3456 WMIC.exe Token: 34 3456 WMIC.exe Token: 35 3456 WMIC.exe Token: 36 3456 WMIC.exe Token: SeIncreaseQuotaPrivilege 3456 WMIC.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2572 wrote to memory of 1728 2572 0x000600000002316e-145.exe 84 PID 2572 wrote to memory of 1728 2572 0x000600000002316e-145.exe 84 PID 2572 wrote to memory of 636 2572 0x000600000002316e-145.exe 86 PID 2572 wrote to memory of 636 2572 0x000600000002316e-145.exe 86 PID 636 wrote to memory of 3456 636 cmd.exe 88 PID 636 wrote to memory of 3456 636 cmd.exe 88 PID 2572 wrote to memory of 1900 2572 0x000600000002316e-145.exe 89 PID 2572 wrote to memory of 1900 2572 0x000600000002316e-145.exe 89 PID 1900 wrote to memory of 260 1900 cmd.exe 91 PID 1900 wrote to memory of 260 1900 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000600000002316e-145.exe"C:\Users\Admin\AppData\Local\Temp\0x000600000002316e-145.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:260
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL
- Size 2KB
- SHA256 5087b8c7f2cecceac61d7bd02b939888cf2cc5a452676f28fd5c076eb1ae7ea7
- MD5 dce9b749d38fdc247ab517e8a76e6102
- SHA1 d6c5b6548e1a3da3326bd097c50c49fc7906be3f
- SHA512 56c276f0a070da656c98520aa720994d78f1bf0bbb085a5f6fb4fd18fed2bbba1eb8e97b54d58eaa9a978d21d64678170f49c020feb19d8545d158a2d8d58446
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
- Size 71KB
- SHA256 9013688dec264c615178e151c2eb5f0b2eb9fe8cfad867b311d8581d921c73f3
- MD5 92d24961d2ebaacf1ace5463dfc9930d
- SHA1 99ffaf6904ab616c33a37ce01d383e4a493df335
- SHA512 77598c77f219ab5234b8b84bcfe873f40e7464b224fac3c8568b300d3f2563f7ef5ad9ec5cccc0d719e7d3e489a164b04b6b36316196afea0b8051de3c751cc7
- SSDEEP 1536:dYk/Q/OccbxYiWU/vXyVOlgZiHGOM7nF+ABbauqzgd:dH/Q/6Zp/viVwg0GOM7Vzd
- MD5 SHA1 SHA512 SSDEEP