Analysis
- max time kernel
139s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2023, 13:45
Behavioral task
behavioral1
Sample
ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe
Resource
win7-20231025-en
windows7-x64
10 signatures
150 seconds
General
- Target ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe
- Size 1.8MB
- Sample231113-q2stpsdd27
- SHA256 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a
- MD5 9d0333553cb226eb988a8ab4dcf7db19
- SHA1 049e34dca86c991ebe4190bcc2cbfad4ea3c10ae
- SHA512 51a9490d69a3b3c9479196e96447e85dacaa5128980ee73660c6625456f6f567a5995f0241e5c165e05401daa75226b959658e3ff1e3122858142a6e36d5cbae
- SSDEEP 49152:j7hpVNwh/s6OjFpF2jlJNdASvFgyjE5Ph/KKlUm3ee:jo/s72BJNdAS30hC0
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 1 IoCs
pid Process 4720 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53\Blob = 030000000100000014000000151682f5218c0a511c28f4060a73b9ca78ce9a531400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba972379504000000010000001000000029f1c1b26d92e893b6e6852ab708cce10f00000001000000200000005aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be19000000010000001000000070d4f0bec2078234214bd651643b02405c0000000100000004000000800100001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000640400003082046030820248a0030201020210079e492886376fd40848c23fc631e463300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381e53081e2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b050003820201001b7f252b907a0876007718e1c32e8a364c417ebf174be330d75b0c7e9c96986f7bb068c02444cce2f2fcd1eadbd29f01f9174d0c9d55fda5ad6dd22f3f4b72c02eae73c7251657c23e15ade031d10a84846c6278423122461aed7a40bf9716814477ca6c7b5d215c07f2119121bfe12fc2ef6efd0520e4b4f779f32dbb372af0c6b1acac51f51fb35a1e66ce580718387f71a93c83bad7bc829e9a760f9eb029fdcbf38907481bfeab932e14210d5faf8eb754ab5d0ed45b4c71d092ea3da3369b7c1fe03b55b9d85353cc8366bb4adc810600188bf4b3d748b11341b9c4b69ecf2c778e42200b807e9fc5ab48dbbc6f048d6c4629020d708a1df11273b64624429e2a1718e3acc798c272cc6d2d766ddd2c2b2696a5cf21081be5da2fcbef9f7393aef8365f478f9728ceabe29826988bfdee28322229ed4c9509c420fa07e1862c44f68147c0e46232ed1dd83c488896c35e91b6af7b59a4eee3869cc78858ca282a66559b8580b91dd8402bc91c133ca9ebde99c21640f6f5a4ae2a256c52bac7044cb432bbfc385ca00c617b57ec774e50cfaf06a20f378ce10ed2d32f1abd9c713ecce1f8d1a8a3bd04f619c0f986aff50e1aaa956befca47714b631c4d96db55230a9d0f8175a0e640f56446036ecefa6a7d06eca4340674da53d8b9b8c6237da9f82a2da482a62e2d11cae6cd31587985e6721ca79fd34cd066d0a7bb ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeAssignPrimaryTokenPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeLockMemoryPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeIncreaseQuotaPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeMachineAccountPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeTcbPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeSecurityPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeTakeOwnershipPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeLoadDriverPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeSystemProfilePrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeSystemtimePrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeProfSingleProcessPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeIncBasePriorityPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeCreatePagefilePrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeCreatePermanentPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeBackupPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeRestorePrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeShutdownPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeDebugPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeAuditPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeSystemEnvironmentPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeChangeNotifyPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeRemoteShutdownPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeUndockPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeSyncAgentPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeEnableDelegationPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeManageVolumePrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeImpersonatePrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeCreateGlobalPrivilege 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: 31 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: 32 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: 33 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: 34 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: 35 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe Token: SeDebugPrivilege 4720 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3752 wrote to memory of 4200 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe 85 PID 3752 wrote to memory of 4200 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe 85 PID 3752 wrote to memory of 4200 3752 ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe 85 PID 4200 wrote to memory of 4720 4200 cmd.exe 87 PID 4200 wrote to memory of 4720 4200 cmd.exe 87 PID 4200 wrote to memory of 4720 4200 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe"C:\Users\Admin\AppData\Local\Temp\ee1f9f03b6ae0cbf83f91fe71867e7b5ae6c7cb207da240f9e27c96f07e1060a.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-