Analysis
- max time kernel
90s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
27/03/2023, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
WWSBot.exe
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
General
- Target WWSBot.exe
- Size 307.5MB
- Sample230327-jl3kmscd26
- SHA256 9ca89cf3afe2d41cedf5c361a43388d90c6e69ff7625e0209c4b135b2e448d45
- MD5 9be38374c8a6d743747494d645dbe76b
- SHA1 123c3a9149b00d50c2b20aada2c6ae9f3cce55e5
- SHA512 29dbda5921deb999010379a996f16f0640de891dc85f36e4175f3ec0dd381bfe8c52da05d42408d4b036427ba8d4c00f79149d25280b4cffc291cdb4e0643727
- SSDEEP 24576:tN+qbmS6e/1ijwnQFpP1CJUmWw5/Ky9YawDZoaZC0gvbm49kLDA5gHdf6sxJwESo:WqbmSL/0wnQX1C3gk+lKbyf/z1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
aurora
C2
-
94.142.138.29:8081
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2280 set thread context of 4132 2280 WWSBot.exe 87 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4420 wmic.exe Token: SeSecurityPrivilege 4420 wmic.exe Token: SeTakeOwnershipPrivilege 4420 wmic.exe Token: SeLoadDriverPrivilege 4420 wmic.exe Token: SeSystemProfilePrivilege 4420 wmic.exe Token: SeSystemtimePrivilege 4420 wmic.exe Token: SeProfSingleProcessPrivilege 4420 wmic.exe Token: SeIncBasePriorityPrivilege 4420 wmic.exe Token: SeCreatePagefilePrivilege 4420 wmic.exe Token: SeBackupPrivilege 4420 wmic.exe Token: SeRestorePrivilege 4420 wmic.exe Token: SeShutdownPrivilege 4420 wmic.exe Token: SeDebugPrivilege 4420 wmic.exe Token: SeSystemEnvironmentPrivilege 4420 wmic.exe Token: SeRemoteShutdownPrivilege 4420 wmic.exe Token: SeUndockPrivilege 4420 wmic.exe Token: SeManageVolumePrivilege 4420 wmic.exe Token: 33 4420 wmic.exe Token: 34 4420 wmic.exe Token: 35 4420 wmic.exe Token: 36 4420 wmic.exe Token: SeIncreaseQuotaPrivilege 4420 wmic.exe Token: SeSecurityPrivilege 4420 wmic.exe Token: SeTakeOwnershipPrivilege 4420 wmic.exe Token: SeLoadDriverPrivilege 4420 wmic.exe Token: SeSystemProfilePrivilege 4420 wmic.exe Token: SeSystemtimePrivilege 4420 wmic.exe Token: SeProfSingleProcessPrivilege 4420 wmic.exe Token: SeIncBasePriorityPrivilege 4420 wmic.exe Token: SeCreatePagefilePrivilege 4420 wmic.exe Token: SeBackupPrivilege 4420 wmic.exe Token: SeRestorePrivilege 4420 wmic.exe Token: SeShutdownPrivilege 4420 wmic.exe Token: SeDebugPrivilege 4420 wmic.exe Token: SeSystemEnvironmentPrivilege 4420 wmic.exe Token: SeRemoteShutdownPrivilege 4420 wmic.exe Token: SeUndockPrivilege 4420 wmic.exe Token: SeManageVolumePrivilege 4420 wmic.exe Token: 33 4420 wmic.exe Token: 34 4420 wmic.exe Token: 35 4420 wmic.exe Token: 36 4420 wmic.exe Token: SeIncreaseQuotaPrivilege 3764 WMIC.exe Token: SeSecurityPrivilege 3764 WMIC.exe Token: SeTakeOwnershipPrivilege 3764 WMIC.exe Token: SeLoadDriverPrivilege 3764 WMIC.exe Token: SeSystemProfilePrivilege 3764 WMIC.exe Token: SeSystemtimePrivilege 3764 WMIC.exe Token: SeProfSingleProcessPrivilege 3764 WMIC.exe Token: SeIncBasePriorityPrivilege 3764 WMIC.exe Token: SeCreatePagefilePrivilege 3764 WMIC.exe Token: SeBackupPrivilege 3764 WMIC.exe Token: SeRestorePrivilege 3764 WMIC.exe Token: SeShutdownPrivilege 3764 WMIC.exe Token: SeDebugPrivilege 3764 WMIC.exe Token: SeSystemEnvironmentPrivilege 3764 WMIC.exe Token: SeRemoteShutdownPrivilege 3764 WMIC.exe Token: SeUndockPrivilege 3764 WMIC.exe Token: SeManageVolumePrivilege 3764 WMIC.exe Token: 33 3764 WMIC.exe Token: 34 3764 WMIC.exe Token: 35 3764 WMIC.exe Token: 36 3764 WMIC.exe Token: SeIncreaseQuotaPrivilege 3764 WMIC.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 2280 wrote to memory of 4132 2280 WWSBot.exe 87 PID 4132 wrote to memory of 4420 4132 WWSBot.exe 88 PID 4132 wrote to memory of 4420 4132 WWSBot.exe 88 PID 4132 wrote to memory of 316 4132 WWSBot.exe 90 PID 4132 wrote to memory of 316 4132 WWSBot.exe 90 PID 316 wrote to memory of 3764 316 cmd.exe 93 PID 316 wrote to memory of 3764 316 cmd.exe 93 PID 4132 wrote to memory of 3360 4132 WWSBot.exe 94 PID 4132 wrote to memory of 3360 4132 WWSBot.exe 94 PID 3360 wrote to memory of 4220 3360 cmd.exe 96 PID 3360 wrote to memory of 4220 3360 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\WWSBot.exe"C:\Users\Admin\AppData\Local\Temp\WWSBot.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\WWSBot.exe"C:\Users\Admin\AppData\Local\Temp\WWSBot.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵PID:4220
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL
- Size 2KB
- SHA256 68cafb091d3642a1ad2440bdb51834086945ded836ea25c8f75de7e5fc568d85
- MD5 77e31b1123e94ce5720ceb729a425798
- SHA1 2b65c95f27d8dca23864a3ed4f78490039ae27bf
- SHA512 9c660381b859040e20745a1cf42646af3bd3780e2795a5ff3cedc61db9877b608d1fc431a1bd3ba3f25dd3643898b1c0f2abfc067c6634e4ce65de2d4c0c724a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
- Size 71KB
- SHA256 448b329f3a10bbe3e8f86cd91509c2783b63d28a375231eb23724f5e141420f2
- MD5 386c014d0948d4fc41afa98cfca9022e
- SHA1 786cc52d9b962f55f92202c7d50c3707eb62607b
- SHA512 13d46209c6b052977d6242763b54ac5e35b389e765c82ba773b520ebf5eacabdfdc22b642cb9760e39ad59dd82fa40a31a8d41fd6dd7ea9c9ad08c57b7d8150f
- SSDEEP 1536:5KYk/Q/OccbxYiWU/vXyVOlgZiHGOM7nF+ABbauqzgC:8H/Q/6Zp/viVwg0GOM7VzC
- MD5 SHA1 SHA512 SSDEEP