Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17-03-2023 16:19
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
4.8MB
-
MD5
d442830fc92de9465d9bf425922173a5
-
SHA1
27eaed777470e6a9f855894b2af3c7baa1c812eb
-
SHA256
5892a93d287a1e4bd97fb09b79b6e2af5643103511f3678c8212ec803ff3b449
-
SHA512
1ce42ab9055bf0c15f8f4b90820c8d4c74f348dc1e1833d26f55f61b671cdafee24a0777ea60a3a5cf5b297c31380a79a1a7d0568c81886f2472d265f77c7146
-
SSDEEP
98304:9j3/I9FTuPXPlGUi317EPTiu0ENWS5ywGDZHU:9/MF4l5GgUEMSrwU
Malware Config
Extracted
aurora
138.201.198.8:8081
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 336 set thread context of 1936 336 file.exe file.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1456 wmic.exe Token: SeSecurityPrivilege 1456 wmic.exe Token: SeTakeOwnershipPrivilege 1456 wmic.exe Token: SeLoadDriverPrivilege 1456 wmic.exe Token: SeSystemProfilePrivilege 1456 wmic.exe Token: SeSystemtimePrivilege 1456 wmic.exe Token: SeProfSingleProcessPrivilege 1456 wmic.exe Token: SeIncBasePriorityPrivilege 1456 wmic.exe Token: SeCreatePagefilePrivilege 1456 wmic.exe Token: SeBackupPrivilege 1456 wmic.exe Token: SeRestorePrivilege 1456 wmic.exe Token: SeShutdownPrivilege 1456 wmic.exe Token: SeDebugPrivilege 1456 wmic.exe Token: SeSystemEnvironmentPrivilege 1456 wmic.exe Token: SeRemoteShutdownPrivilege 1456 wmic.exe Token: SeUndockPrivilege 1456 wmic.exe Token: SeManageVolumePrivilege 1456 wmic.exe Token: 33 1456 wmic.exe Token: 34 1456 wmic.exe Token: 35 1456 wmic.exe Token: SeIncreaseQuotaPrivilege 1456 wmic.exe Token: SeSecurityPrivilege 1456 wmic.exe Token: SeTakeOwnershipPrivilege 1456 wmic.exe Token: SeLoadDriverPrivilege 1456 wmic.exe Token: SeSystemProfilePrivilege 1456 wmic.exe Token: SeSystemtimePrivilege 1456 wmic.exe Token: SeProfSingleProcessPrivilege 1456 wmic.exe Token: SeIncBasePriorityPrivilege 1456 wmic.exe Token: SeCreatePagefilePrivilege 1456 wmic.exe Token: SeBackupPrivilege 1456 wmic.exe Token: SeRestorePrivilege 1456 wmic.exe Token: SeShutdownPrivilege 1456 wmic.exe Token: SeDebugPrivilege 1456 wmic.exe Token: SeSystemEnvironmentPrivilege 1456 wmic.exe Token: SeRemoteShutdownPrivilege 1456 wmic.exe Token: SeUndockPrivilege 1456 wmic.exe Token: SeManageVolumePrivilege 1456 wmic.exe Token: 33 1456 wmic.exe Token: 34 1456 wmic.exe Token: 35 1456 wmic.exe Token: SeIncreaseQuotaPrivilege 960 WMIC.exe Token: SeSecurityPrivilege 960 WMIC.exe Token: SeTakeOwnershipPrivilege 960 WMIC.exe Token: SeLoadDriverPrivilege 960 WMIC.exe Token: SeSystemProfilePrivilege 960 WMIC.exe Token: SeSystemtimePrivilege 960 WMIC.exe Token: SeProfSingleProcessPrivilege 960 WMIC.exe Token: SeIncBasePriorityPrivilege 960 WMIC.exe Token: SeCreatePagefilePrivilege 960 WMIC.exe Token: SeBackupPrivilege 960 WMIC.exe Token: SeRestorePrivilege 960 WMIC.exe Token: SeShutdownPrivilege 960 WMIC.exe Token: SeDebugPrivilege 960 WMIC.exe Token: SeSystemEnvironmentPrivilege 960 WMIC.exe Token: SeRemoteShutdownPrivilege 960 WMIC.exe Token: SeUndockPrivilege 960 WMIC.exe Token: SeManageVolumePrivilege 960 WMIC.exe Token: 33 960 WMIC.exe Token: 34 960 WMIC.exe Token: 35 960 WMIC.exe Token: SeIncreaseQuotaPrivilege 960 WMIC.exe Token: SeSecurityPrivilege 960 WMIC.exe Token: SeTakeOwnershipPrivilege 960 WMIC.exe Token: SeLoadDriverPrivilege 960 WMIC.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
file.exefile.execmd.execmd.exedescription pid process target process PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 336 wrote to memory of 1936 336 file.exe file.exe PID 1936 wrote to memory of 1456 1936 file.exe wmic.exe PID 1936 wrote to memory of 1456 1936 file.exe wmic.exe PID 1936 wrote to memory of 1456 1936 file.exe wmic.exe PID 1936 wrote to memory of 1456 1936 file.exe wmic.exe PID 1936 wrote to memory of 1520 1936 file.exe cmd.exe PID 1936 wrote to memory of 1520 1936 file.exe cmd.exe PID 1936 wrote to memory of 1520 1936 file.exe cmd.exe PID 1936 wrote to memory of 1520 1936 file.exe cmd.exe PID 1520 wrote to memory of 960 1520 cmd.exe WMIC.exe PID 1520 wrote to memory of 960 1520 cmd.exe WMIC.exe PID 1520 wrote to memory of 960 1520 cmd.exe WMIC.exe PID 1520 wrote to memory of 960 1520 cmd.exe WMIC.exe PID 1936 wrote to memory of 1644 1936 file.exe cmd.exe PID 1936 wrote to memory of 1644 1936 file.exe cmd.exe PID 1936 wrote to memory of 1644 1936 file.exe cmd.exe PID 1936 wrote to memory of 1644 1936 file.exe cmd.exe PID 1644 wrote to memory of 1808 1644 cmd.exe WMIC.exe PID 1644 wrote to memory of 1808 1644 cmd.exe WMIC.exe PID 1644 wrote to memory of 1808 1644 cmd.exe WMIC.exe PID 1644 wrote to memory of 1808 1644 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmotFilesize
71KB
MD57634ebd082abbba35a8e6a300ec83c51
SHA1953666e70fbed932e4bed446f1d1e432781972b7
SHA256792aa1b2f647c981a8778a35717809ff0783bc4b6c022e6ed049c1029f6c584f
SHA5126f95e7c7c4548ad206294e5fc13f9ed0bad9476e5775ac4e06bd324c6e0a14382fcf5f604e5899084ee2f3733405716d60842f3393d5fa174902dbb055d40f3e
-
memory/336-54-0x0000000000900000-0x0000000000DCE000-memory.dmpFilesize
4.8MB
-
memory/336-55-0x0000000004F50000-0x0000000004F90000-memory.dmpFilesize
256KB
-
memory/336-56-0x0000000006270000-0x00000000066E6000-memory.dmpFilesize
4.5MB
-
memory/336-57-0x000000000BA60000-0x000000000BCAE000-memory.dmpFilesize
2.3MB
-
memory/336-58-0x00000000004E0000-0x00000000004FC000-memory.dmpFilesize
112KB
-
memory/1936-64-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-70-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-62-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-63-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-60-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-65-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1936-67-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-69-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-61-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-71-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-72-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-73-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-74-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-75-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-59-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1936-107-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB