Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
31-10-2023 09:33
Behavioral task
behavioral1
Sample
56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe
Resource
win7-20231020-en
General
-
Target
56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe
-
Size
1.5MB
-
MD5
53b3a93bc019fe2df382b5d74968d119
-
SHA1
3f712a8fcafef9f9a5fc607295508dd0df356751
-
SHA256
56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0
-
SHA512
510c977d5a6fd7ed8ec113a328a7d4631e88b3e3692fc49e81e810bc5fc46660618d420d967be7320a80005c692abbf1f0ec4ac9a4a7e5448b23168f6dc766f0
-
SSDEEP
24576:U9z7hp10GnN4BhDEYsN4OikFDEQ/lbCFjWlqIgV0edASvoxygyjTYofy9bS/C+yp:e7hpVNwh/s6OjFpF2jlJNdASvFgyjE5d
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3004 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exetaskkill.exedescription pid process Token: SeCreateTokenPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeAssignPrimaryTokenPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeLockMemoryPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeIncreaseQuotaPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeMachineAccountPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeTcbPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeSecurityPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeTakeOwnershipPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeLoadDriverPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeSystemProfilePrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeSystemtimePrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeProfSingleProcessPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeIncBasePriorityPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeCreatePagefilePrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeCreatePermanentPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeBackupPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeRestorePrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeShutdownPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeDebugPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeAuditPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeSystemEnvironmentPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeChangeNotifyPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeRemoteShutdownPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeUndockPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeSyncAgentPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeEnableDelegationPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeManageVolumePrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeImpersonatePrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeCreateGlobalPrivilege 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: 31 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: 32 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: 33 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: 34 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: 35 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe Token: SeDebugPrivilege 3004 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.execmd.exedescription pid process target process PID 2232 wrote to memory of 2792 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe cmd.exe PID 2232 wrote to memory of 2792 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe cmd.exe PID 2232 wrote to memory of 2792 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe cmd.exe PID 2232 wrote to memory of 2792 2232 56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe cmd.exe PID 2792 wrote to memory of 3004 2792 cmd.exe taskkill.exe PID 2792 wrote to memory of 3004 2792 cmd.exe taskkill.exe PID 2792 wrote to memory of 3004 2792 cmd.exe taskkill.exe PID 2792 wrote to memory of 3004 2792 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe"C:\Users\Admin\AppData\Local\Temp\56b874ec1b3cef9f4234a01a1e5387c5c5179b2e7349f987b3da98fb1946aac0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CabE487.tmpFilesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\Local\Temp\TarE4C9.tmpFilesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf