Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17-03-2023 11:32
Static task
static1
Behavioral task
behavioral1
Sample
1431d295525534f244dd34a8a311b87f.exe
Resource
win7-20230220-en
General
-
Target
1431d295525534f244dd34a8a311b87f.exe
-
Size
7.5MB
-
MD5
1431d295525534f244dd34a8a311b87f
-
SHA1
2d0d2190ed780bf8dfed135bd1d12cae53860ebe
-
SHA256
60f5cf24370600410d431405a2af891db1e19396a73d437b33f2e9c01e9fb27e
-
SHA512
dd7085d43c12c1c7d59be73e66e5797966f7310fdd40ff2979fc770fa6fb5164484661fdfa7b73f8fc7a2dac32a452683f021e56fa4b1135bbbb9d140794ee02
-
SSDEEP
24576:2H5qGTyaJEUcmADwRqPACrUJJiILBCR5LpWKMuy1rnwNnNQx/PEEDnpfuZWI9pIx:4qGTyMEQADwwACagk+lKo83Vz1
Malware Config
Extracted
aurora
45.15.156.172:8081
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
1431d295525534f244dd34a8a311b87f.exedescription pid process target process PID 1348 set thread context of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 468 wmic.exe Token: SeSecurityPrivilege 468 wmic.exe Token: SeTakeOwnershipPrivilege 468 wmic.exe Token: SeLoadDriverPrivilege 468 wmic.exe Token: SeSystemProfilePrivilege 468 wmic.exe Token: SeSystemtimePrivilege 468 wmic.exe Token: SeProfSingleProcessPrivilege 468 wmic.exe Token: SeIncBasePriorityPrivilege 468 wmic.exe Token: SeCreatePagefilePrivilege 468 wmic.exe Token: SeBackupPrivilege 468 wmic.exe Token: SeRestorePrivilege 468 wmic.exe Token: SeShutdownPrivilege 468 wmic.exe Token: SeDebugPrivilege 468 wmic.exe Token: SeSystemEnvironmentPrivilege 468 wmic.exe Token: SeRemoteShutdownPrivilege 468 wmic.exe Token: SeUndockPrivilege 468 wmic.exe Token: SeManageVolumePrivilege 468 wmic.exe Token: 33 468 wmic.exe Token: 34 468 wmic.exe Token: 35 468 wmic.exe Token: SeIncreaseQuotaPrivilege 468 wmic.exe Token: SeSecurityPrivilege 468 wmic.exe Token: SeTakeOwnershipPrivilege 468 wmic.exe Token: SeLoadDriverPrivilege 468 wmic.exe Token: SeSystemProfilePrivilege 468 wmic.exe Token: SeSystemtimePrivilege 468 wmic.exe Token: SeProfSingleProcessPrivilege 468 wmic.exe Token: SeIncBasePriorityPrivilege 468 wmic.exe Token: SeCreatePagefilePrivilege 468 wmic.exe Token: SeBackupPrivilege 468 wmic.exe Token: SeRestorePrivilege 468 wmic.exe Token: SeShutdownPrivilege 468 wmic.exe Token: SeDebugPrivilege 468 wmic.exe Token: SeSystemEnvironmentPrivilege 468 wmic.exe Token: SeRemoteShutdownPrivilege 468 wmic.exe Token: SeUndockPrivilege 468 wmic.exe Token: SeManageVolumePrivilege 468 wmic.exe Token: 33 468 wmic.exe Token: 34 468 wmic.exe Token: 35 468 wmic.exe Token: SeIncreaseQuotaPrivilege 1056 WMIC.exe Token: SeSecurityPrivilege 1056 WMIC.exe Token: SeTakeOwnershipPrivilege 1056 WMIC.exe Token: SeLoadDriverPrivilege 1056 WMIC.exe Token: SeSystemProfilePrivilege 1056 WMIC.exe Token: SeSystemtimePrivilege 1056 WMIC.exe Token: SeProfSingleProcessPrivilege 1056 WMIC.exe Token: SeIncBasePriorityPrivilege 1056 WMIC.exe Token: SeCreatePagefilePrivilege 1056 WMIC.exe Token: SeBackupPrivilege 1056 WMIC.exe Token: SeRestorePrivilege 1056 WMIC.exe Token: SeShutdownPrivilege 1056 WMIC.exe Token: SeDebugPrivilege 1056 WMIC.exe Token: SeSystemEnvironmentPrivilege 1056 WMIC.exe Token: SeRemoteShutdownPrivilege 1056 WMIC.exe Token: SeUndockPrivilege 1056 WMIC.exe Token: SeManageVolumePrivilege 1056 WMIC.exe Token: 33 1056 WMIC.exe Token: 34 1056 WMIC.exe Token: 35 1056 WMIC.exe Token: SeIncreaseQuotaPrivilege 1056 WMIC.exe Token: SeSecurityPrivilege 1056 WMIC.exe Token: SeTakeOwnershipPrivilege 1056 WMIC.exe Token: SeLoadDriverPrivilege 1056 WMIC.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
1431d295525534f244dd34a8a311b87f.exe1431d295525534f244dd34a8a311b87f.execmd.execmd.exedescription pid process target process PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1348 wrote to memory of 1336 1348 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 1336 wrote to memory of 468 1336 1431d295525534f244dd34a8a311b87f.exe wmic.exe PID 1336 wrote to memory of 468 1336 1431d295525534f244dd34a8a311b87f.exe wmic.exe PID 1336 wrote to memory of 468 1336 1431d295525534f244dd34a8a311b87f.exe wmic.exe PID 1336 wrote to memory of 1820 1336 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 1336 wrote to memory of 1820 1336 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 1336 wrote to memory of 1820 1336 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 1820 wrote to memory of 1056 1820 cmd.exe WMIC.exe PID 1820 wrote to memory of 1056 1820 cmd.exe WMIC.exe PID 1820 wrote to memory of 1056 1820 cmd.exe WMIC.exe PID 1336 wrote to memory of 952 1336 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 1336 wrote to memory of 952 1336 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 1336 wrote to memory of 952 1336 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 952 wrote to memory of 744 952 cmd.exe WMIC.exe PID 952 wrote to memory of 744 952 cmd.exe WMIC.exe PID 952 wrote to memory of 744 952 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1431d295525534f244dd34a8a311b87f.exe"C:\Users\Admin\AppData\Local\Temp\1431d295525534f244dd34a8a311b87f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1431d295525534f244dd34a8a311b87f.exe"C:\Users\Admin\AppData\Local\Temp\1431d295525534f244dd34a8a311b87f.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmotFilesize
71KB
MD56082dd13ad8102d17f9db9cd07600e97
SHA139becc88cea914d843b3c5521038907f2f2f4e71
SHA25640a3f938c8c1eb929771c444d5f8887c42c7cde6281690e2071a2593ba92e48a
SHA512b7d5c716b6339b3138492c8b0cf4c9540a8d8224f9d5e72e34ceab442bdfa9c855473bbed68a489851f019461e1b1f9d86baf067be556c67b948c930899d3c1e
-
memory/1336-61-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmpFilesize
4KB
-
memory/1336-57-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-65-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-66-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-59-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-60-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-62-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-54-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-105-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-56-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-58-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-67-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-68-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-69-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-55-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-81-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-104-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1336-64-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB