Analysis
- max time kernel
145s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
17/03/2023, 13:17
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
General
- Target tmp.exe
- Size 7.5MB
- Sample230317-qjs2ragd36
- SHA256 60f5cf24370600410d431405a2af891db1e19396a73d437b33f2e9c01e9fb27e
- MD5 1431d295525534f244dd34a8a311b87f
- SHA1 2d0d2190ed780bf8dfed135bd1d12cae53860ebe
- SHA512 dd7085d43c12c1c7d59be73e66e5797966f7310fdd40ff2979fc770fa6fb5164484661fdfa7b73f8fc7a2dac32a452683f021e56fa4b1135bbbb9d140794ee02
- SSDEEP 24576:2H5qGTyaJEUcmADwRqPACrUJJiILBCR5LpWKMuy1rnwNnNQx/PEEDnpfuZWI9pIx:4qGTyMEQADwwACagk+lKo83Vz1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
aurora
C2
-
45.15.156.172:8081
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2156 set thread context of 2184 2156 tmp.exe 86 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4136 wmic.exe Token: SeSecurityPrivilege 4136 wmic.exe Token: SeTakeOwnershipPrivilege 4136 wmic.exe Token: SeLoadDriverPrivilege 4136 wmic.exe Token: SeSystemProfilePrivilege 4136 wmic.exe Token: SeSystemtimePrivilege 4136 wmic.exe Token: SeProfSingleProcessPrivilege 4136 wmic.exe Token: SeIncBasePriorityPrivilege 4136 wmic.exe Token: SeCreatePagefilePrivilege 4136 wmic.exe Token: SeBackupPrivilege 4136 wmic.exe Token: SeRestorePrivilege 4136 wmic.exe Token: SeShutdownPrivilege 4136 wmic.exe Token: SeDebugPrivilege 4136 wmic.exe Token: SeSystemEnvironmentPrivilege 4136 wmic.exe Token: SeRemoteShutdownPrivilege 4136 wmic.exe Token: SeUndockPrivilege 4136 wmic.exe Token: SeManageVolumePrivilege 4136 wmic.exe Token: 33 4136 wmic.exe Token: 34 4136 wmic.exe Token: 35 4136 wmic.exe Token: 36 4136 wmic.exe Token: SeIncreaseQuotaPrivilege 4136 wmic.exe Token: SeSecurityPrivilege 4136 wmic.exe Token: SeTakeOwnershipPrivilege 4136 wmic.exe Token: SeLoadDriverPrivilege 4136 wmic.exe Token: SeSystemProfilePrivilege 4136 wmic.exe Token: SeSystemtimePrivilege 4136 wmic.exe Token: SeProfSingleProcessPrivilege 4136 wmic.exe Token: SeIncBasePriorityPrivilege 4136 wmic.exe Token: SeCreatePagefilePrivilege 4136 wmic.exe Token: SeBackupPrivilege 4136 wmic.exe Token: SeRestorePrivilege 4136 wmic.exe Token: SeShutdownPrivilege 4136 wmic.exe Token: SeDebugPrivilege 4136 wmic.exe Token: SeSystemEnvironmentPrivilege 4136 wmic.exe Token: SeRemoteShutdownPrivilege 4136 wmic.exe Token: SeUndockPrivilege 4136 wmic.exe Token: SeManageVolumePrivilege 4136 wmic.exe Token: 33 4136 wmic.exe Token: 34 4136 wmic.exe Token: 35 4136 wmic.exe Token: 36 4136 wmic.exe Token: SeIncreaseQuotaPrivilege 2964 WMIC.exe Token: SeSecurityPrivilege 2964 WMIC.exe Token: SeTakeOwnershipPrivilege 2964 WMIC.exe Token: SeLoadDriverPrivilege 2964 WMIC.exe Token: SeSystemProfilePrivilege 2964 WMIC.exe Token: SeSystemtimePrivilege 2964 WMIC.exe Token: SeProfSingleProcessPrivilege 2964 WMIC.exe Token: SeIncBasePriorityPrivilege 2964 WMIC.exe Token: SeCreatePagefilePrivilege 2964 WMIC.exe Token: SeBackupPrivilege 2964 WMIC.exe Token: SeRestorePrivilege 2964 WMIC.exe Token: SeShutdownPrivilege 2964 WMIC.exe Token: SeDebugPrivilege 2964 WMIC.exe Token: SeSystemEnvironmentPrivilege 2964 WMIC.exe Token: SeRemoteShutdownPrivilege 2964 WMIC.exe Token: SeUndockPrivilege 2964 WMIC.exe Token: SeManageVolumePrivilege 2964 WMIC.exe Token: 33 2964 WMIC.exe Token: 34 2964 WMIC.exe Token: 35 2964 WMIC.exe Token: 36 2964 WMIC.exe Token: SeIncreaseQuotaPrivilege 2964 WMIC.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2156 wrote to memory of 2184 2156 tmp.exe 86 PID 2184 wrote to memory of 4136 2184 tmp.exe 87 PID 2184 wrote to memory of 4136 2184 tmp.exe 87 PID 2184 wrote to memory of 3044 2184 tmp.exe 89 PID 2184 wrote to memory of 3044 2184 tmp.exe 89 PID 3044 wrote to memory of 2964 3044 cmd.exe 91 PID 3044 wrote to memory of 2964 3044 cmd.exe 91 PID 2184 wrote to memory of 4992 2184 tmp.exe 92 PID 2184 wrote to memory of 4992 2184 tmp.exe 92 PID 4992 wrote to memory of 1040 4992 cmd.exe 94 PID 4992 wrote to memory of 1040 4992 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵PID:1040
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL
- Size 2KB
- SHA256 06b631bf6ea97d79ea2215efa0323aab64bd1b53283ef8640c2a8fd37cac9caa
- MD5 8c7576873886d730d55e52070f35fea0
- SHA1 cf8b732cb49dad4e69c8948a6f0b7b87b9b0ccf1
- SHA512 374dff92bb31dfb74ec66084dcc8764e166f4adc7c57113d813b430e420b8bcc9e1300aae5f4b2ff09ad3d5b152a8240901ed3acfc76c4788d9ad3442cd2db28
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
- Size 72KB
- SHA256 c94d79620e27865ba796be4cbfd98087da8a47f78e07e7220084de05354381dd
- MD5 5aeeafe26d1e0441647e0b0d7b880c81
- SHA1 45a00f65a99d1cec35bd6a21891ac469a86f451c
- SHA512 3e70b065b194f14f1ec2735b6003943b492c29a78e12029ae42574cda7fdc785c24eae0c98fbd9a1167ac938387d78aead68688299e3aaf1971794938ab903c5
- SSDEEP 1536:Ct4210Yk/Q/OccbxYiWU/vXyVOlgZiHGOM7nF+ABbauqzgW:C2H/Q/6Zp/viVwg0GOM7VzW
- MD5 SHA1 SHA512 SSDEEP