Analysis
-
max time kernel
38s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
17-03-2023 11:32
Static task
static1
Behavioral task
behavioral1
Sample
1431d295525534f244dd34a8a311b87f.exe
Resource
win7-20230220-en
General
-
Target
1431d295525534f244dd34a8a311b87f.exe
-
Size
7.5MB
-
MD5
1431d295525534f244dd34a8a311b87f
-
SHA1
2d0d2190ed780bf8dfed135bd1d12cae53860ebe
-
SHA256
60f5cf24370600410d431405a2af891db1e19396a73d437b33f2e9c01e9fb27e
-
SHA512
dd7085d43c12c1c7d59be73e66e5797966f7310fdd40ff2979fc770fa6fb5164484661fdfa7b73f8fc7a2dac32a452683f021e56fa4b1135bbbb9d140794ee02
-
SSDEEP
24576:2H5qGTyaJEUcmADwRqPACrUJJiILBCR5LpWKMuy1rnwNnNQx/PEEDnpfuZWI9pIx:4qGTyMEQADwwACagk+lKo83Vz1
Malware Config
Extracted
aurora
45.15.156.172:8081
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
1431d295525534f244dd34a8a311b87f.exedescription pid process target process PID 4784 set thread context of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1160 wmic.exe Token: SeSecurityPrivilege 1160 wmic.exe Token: SeTakeOwnershipPrivilege 1160 wmic.exe Token: SeLoadDriverPrivilege 1160 wmic.exe Token: SeSystemProfilePrivilege 1160 wmic.exe Token: SeSystemtimePrivilege 1160 wmic.exe Token: SeProfSingleProcessPrivilege 1160 wmic.exe Token: SeIncBasePriorityPrivilege 1160 wmic.exe Token: SeCreatePagefilePrivilege 1160 wmic.exe Token: SeBackupPrivilege 1160 wmic.exe Token: SeRestorePrivilege 1160 wmic.exe Token: SeShutdownPrivilege 1160 wmic.exe Token: SeDebugPrivilege 1160 wmic.exe Token: SeSystemEnvironmentPrivilege 1160 wmic.exe Token: SeRemoteShutdownPrivilege 1160 wmic.exe Token: SeUndockPrivilege 1160 wmic.exe Token: SeManageVolumePrivilege 1160 wmic.exe Token: 33 1160 wmic.exe Token: 34 1160 wmic.exe Token: 35 1160 wmic.exe Token: 36 1160 wmic.exe Token: SeIncreaseQuotaPrivilege 1160 wmic.exe Token: SeSecurityPrivilege 1160 wmic.exe Token: SeTakeOwnershipPrivilege 1160 wmic.exe Token: SeLoadDriverPrivilege 1160 wmic.exe Token: SeSystemProfilePrivilege 1160 wmic.exe Token: SeSystemtimePrivilege 1160 wmic.exe Token: SeProfSingleProcessPrivilege 1160 wmic.exe Token: SeIncBasePriorityPrivilege 1160 wmic.exe Token: SeCreatePagefilePrivilege 1160 wmic.exe Token: SeBackupPrivilege 1160 wmic.exe Token: SeRestorePrivilege 1160 wmic.exe Token: SeShutdownPrivilege 1160 wmic.exe Token: SeDebugPrivilege 1160 wmic.exe Token: SeSystemEnvironmentPrivilege 1160 wmic.exe Token: SeRemoteShutdownPrivilege 1160 wmic.exe Token: SeUndockPrivilege 1160 wmic.exe Token: SeManageVolumePrivilege 1160 wmic.exe Token: 33 1160 wmic.exe Token: 34 1160 wmic.exe Token: 35 1160 wmic.exe Token: 36 1160 wmic.exe Token: SeIncreaseQuotaPrivilege 228 WMIC.exe Token: SeSecurityPrivilege 228 WMIC.exe Token: SeTakeOwnershipPrivilege 228 WMIC.exe Token: SeLoadDriverPrivilege 228 WMIC.exe Token: SeSystemProfilePrivilege 228 WMIC.exe Token: SeSystemtimePrivilege 228 WMIC.exe Token: SeProfSingleProcessPrivilege 228 WMIC.exe Token: SeIncBasePriorityPrivilege 228 WMIC.exe Token: SeCreatePagefilePrivilege 228 WMIC.exe Token: SeBackupPrivilege 228 WMIC.exe Token: SeRestorePrivilege 228 WMIC.exe Token: SeShutdownPrivilege 228 WMIC.exe Token: SeDebugPrivilege 228 WMIC.exe Token: SeSystemEnvironmentPrivilege 228 WMIC.exe Token: SeRemoteShutdownPrivilege 228 WMIC.exe Token: SeUndockPrivilege 228 WMIC.exe Token: SeManageVolumePrivilege 228 WMIC.exe Token: 33 228 WMIC.exe Token: 34 228 WMIC.exe Token: 35 228 WMIC.exe Token: 36 228 WMIC.exe Token: SeIncreaseQuotaPrivilege 228 WMIC.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1431d295525534f244dd34a8a311b87f.exe1431d295525534f244dd34a8a311b87f.execmd.execmd.exedescription pid process target process PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 4784 wrote to memory of 2628 4784 1431d295525534f244dd34a8a311b87f.exe 1431d295525534f244dd34a8a311b87f.exe PID 2628 wrote to memory of 1160 2628 1431d295525534f244dd34a8a311b87f.exe wmic.exe PID 2628 wrote to memory of 1160 2628 1431d295525534f244dd34a8a311b87f.exe wmic.exe PID 2628 wrote to memory of 2516 2628 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 2628 wrote to memory of 2516 2628 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 2516 wrote to memory of 228 2516 cmd.exe WMIC.exe PID 2516 wrote to memory of 228 2516 cmd.exe WMIC.exe PID 2628 wrote to memory of 208 2628 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 2628 wrote to memory of 208 2628 1431d295525534f244dd34a8a311b87f.exe cmd.exe PID 208 wrote to memory of 2420 208 cmd.exe WMIC.exe PID 208 wrote to memory of 2420 208 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1431d295525534f244dd34a8a311b87f.exe"C:\Users\Admin\AppData\Local\Temp\1431d295525534f244dd34a8a311b87f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1431d295525534f244dd34a8a311b87f.exe"C:\Users\Admin\AppData\Local\Temp\1431d295525534f244dd34a8a311b87f.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaLFilesize
2KB
MD518da5c19d469f921ff9d44f1f17de97b
SHA1bef606053494e1f516431d40f2aca29cf1deeb20
SHA256662f6389650db2471a13412664d05cfed46fef73dd1d30cf16d2c8ceeee33eb0
SHA5129eee1b05c10544813c2eb89c48369d78e5b9260fddd8e90a34f06ac8ea2955860083c6c8ac31089276e97e269b87b4ac0c43e9dcdb7bd6091759dccb4ac0e71d
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
71KB
MD546988a922937a39036d6b71e62d0f966
SHA14a997f2a0360274ec7990aac156870a5a7030665
SHA2565954db23a8424f6cb1e933387d0866910c45615f54342aa0f6dd597174393de6
SHA512dd7774668cd24c303e670e7d096794aca67593b8d8a9b3b38aa08c148f67e74c07041f25941465b3ae030bafd76384b4b79d41c1eeebe5bd11d94ab25ef00e9d
-
memory/2628-133-0x0000000000B90000-0x0000000000EEC000-memory.dmpFilesize
3.4MB
-
memory/2628-138-0x0000000000B90000-0x0000000000EEC000-memory.dmpFilesize
3.4MB
-
memory/2628-143-0x0000000000B90000-0x0000000000EEC000-memory.dmpFilesize
3.4MB
-
memory/2628-144-0x0000000000B90000-0x0000000000EEC000-memory.dmpFilesize
3.4MB
-
memory/2628-145-0x0000000000B90000-0x0000000000EEC000-memory.dmpFilesize
3.4MB
-
memory/2628-146-0x0000000000B90000-0x0000000000EEC000-memory.dmpFilesize
3.4MB
-
memory/2628-147-0x0000000000B90000-0x0000000000EEC000-memory.dmpFilesize
3.4MB
-
memory/2628-148-0x0000000000B90000-0x0000000000EEC000-memory.dmpFilesize
3.4MB
-
memory/2628-149-0x0000000000B90000-0x0000000000EEC000-memory.dmpFilesize
3.4MB