Analysis
- max time kernel
137s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system - submitted
15/11/2023, 23:38
Behavioral task
behavioral1
Sample
0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe
Resource
win7-20231023-en
windows7-x64
10 signatures
150 seconds
General
- Target 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe
- Size 2.1MB
- Sample231115-3mrpbaef26
- SHA256 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62
- MD5 6c77b086d9ce1d6673909cefee14b4de
- SHA1 3c781df1e37fe3a4d15ea94b228913d561cbb9e2
- SHA512 fff69bb18e3149aba44859edd9e333347a0f2846e11ecdd9718265dfca35888ba760da15ef5cab2b2c5a667e1a5bce5bf9fabbc63848229df38830615b32ff98
- SSDEEP 49152:j7hpVNwh/s6OjFpF2jlJNdASvFgyjE5BmxJQ4kD:jo/s72BJNdAS3pq4k
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 1 IoCs
pid Process 4824 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53\Blob = 030000000100000014000000151682f5218c0a511c28f4060a73b9ca78ce9a531400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba972379504000000010000001000000029f1c1b26d92e893b6e6852ab708cce10f00000001000000200000005aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be19000000010000001000000070d4f0bec2078234214bd651643b02405c0000000100000004000000800100001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000640400003082046030820248a0030201020210079e492886376fd40848c23fc631e463300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381e53081e2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b050003820201001b7f252b907a0876007718e1c32e8a364c417ebf174be330d75b0c7e9c96986f7bb068c02444cce2f2fcd1eadbd29f01f9174d0c9d55fda5ad6dd22f3f4b72c02eae73c7251657c23e15ade031d10a84846c6278423122461aed7a40bf9716814477ca6c7b5d215c07f2119121bfe12fc2ef6efd0520e4b4f779f32dbb372af0c6b1acac51f51fb35a1e66ce580718387f71a93c83bad7bc829e9a760f9eb029fdcbf38907481bfeab932e14210d5faf8eb754ab5d0ed45b4c71d092ea3da3369b7c1fe03b55b9d85353cc8366bb4adc810600188bf4b3d748b11341b9c4b69ecf2c778e42200b807e9fc5ab48dbbc6f048d6c4629020d708a1df11273b64624429e2a1718e3acc798c272cc6d2d766ddd2c2b2696a5cf21081be5da2fcbef9f7393aef8365f478f9728ceabe29826988bfdee28322229ed4c9509c420fa07e1862c44f68147c0e46232ed1dd83c488896c35e91b6af7b59a4eee3869cc78858ca282a66559b8580b91dd8402bc91c133ca9ebde99c21640f6f5a4ae2a256c52bac7044cb432bbfc385ca00c617b57ec774e50cfaf06a20f378ce10ed2d32f1abd9c713ecce1f8d1a8a3bd04f619c0f986aff50e1aaa956befca47714b631c4d96db55230a9d0f8175a0e640f56446036ecefa6a7d06eca4340674da53d8b9b8c6237da9f82a2da482a62e2d11cae6cd31587985e6721ca79fd34cd066d0a7bb 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Key created \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeAssignPrimaryTokenPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeLockMemoryPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeIncreaseQuotaPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeMachineAccountPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeTcbPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeSecurityPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeTakeOwnershipPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeLoadDriverPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeSystemProfilePrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeSystemtimePrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeProfSingleProcessPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeIncBasePriorityPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeCreatePagefilePrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeCreatePermanentPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeBackupPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeRestorePrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeShutdownPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeDebugPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeAuditPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeSystemEnvironmentPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeChangeNotifyPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeRemoteShutdownPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeUndockPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeSyncAgentPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeEnableDelegationPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeManageVolumePrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeImpersonatePrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeCreateGlobalPrivilege 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: 31 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: 32 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: 33 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: 34 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: 35 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe Token: SeDebugPrivilege 4824 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2944 wrote to memory of 5004 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe 94 PID 2944 wrote to memory of 5004 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe 94 PID 2944 wrote to memory of 5004 2944 0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe 94 PID 5004 wrote to memory of 4824 5004 cmd.exe 96 PID 5004 wrote to memory of 4824 5004 cmd.exe 96 PID 5004 wrote to memory of 4824 5004 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe"C:\Users\Admin\AppData\Local\Temp\0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-