02364ebdb67771b7d48173321e82bebbd0eb1c71810daf197fac35774cc847c3

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23-11-2023 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
Size

5.9MB
MD5

249242a52c6de7580faf8ae9eed16e40
SHA1

635914243c2ebc9e1c5747e37b52dd937c347437
SHA256

667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec
SHA512

4ba1e57469f9a8d64f254d6375dc0f79510fe15cf5635a668e36646ed26ee59c99bf381a2fc10135e9ba4d886bf51e23215dda6fecb98b1cdd57a729429cde8e
SSDEEP

49152:LPdN+rb/TAvO90dL3BmAFd4A64nsfJvrysOEm7FLRDLDeyIPsE9nS3QVxMdaQSes:zicfXDMbsHbxtEnBZ91I

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2328	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2852	ipconfig.exe
2624	NETSTAT.EXE

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
Token: SeDebugPrivilege	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
Token: SeDebugPrivilege	2328	tasklist.exe
Token: SeDebugPrivilege	2624	NETSTAT.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2084	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	29
PID 3064 wrote to memory of 2084	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	29
PID 3064 wrote to memory of 2084	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	29
PID 3064 wrote to memory of 2992	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	28
PID 3064 wrote to memory of 2992	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	28
PID 3064 wrote to memory of 2992	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	28
PID 2992 wrote to memory of 2852	2992	cmd.exe	32
PID 2992 wrote to memory of 2852	2992	cmd.exe	32
PID 2992 wrote to memory of 2852	2992	cmd.exe	32
PID 3064 wrote to memory of 2672	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	35
PID 3064 wrote to memory of 2672	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	35
PID 3064 wrote to memory of 2672	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	35
PID 2084 wrote to memory of 2328	2084	cmd.exe	34
PID 2084 wrote to memory of 2328	2084	cmd.exe	34
PID 2084 wrote to memory of 2328	2084	cmd.exe	34
PID 2672 wrote to memory of 2788	2672	cmd.exe	36
PID 2672 wrote to memory of 2788	2672	cmd.exe	36
PID 2672 wrote to memory of 2788	2672	cmd.exe	36
PID 3064 wrote to memory of 2720	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	37
PID 3064 wrote to memory of 2720	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	37
PID 3064 wrote to memory of 2720	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	37
PID 3064 wrote to memory of 2696	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	40
PID 3064 wrote to memory of 2696	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	40
PID 3064 wrote to memory of 2696	3064	667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe	40
PID 2720 wrote to memory of 2824	2720	cmd.exe	42
PID 2720 wrote to memory of 2824	2720	cmd.exe	42
PID 2720 wrote to memory of 2824	2720	cmd.exe	42
PID 2696 wrote to memory of 2624	2696	cmd.exe	43
PID 2696 wrote to memory of 2624	2696	cmd.exe	43
PID 2696 wrote to memory of 2624	2696	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
"C:\Users\Admin\AppData\Local\Temp\667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\cmd.exe
  cmd.exe /c "ipconfig /all"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2852
- C:\Windows\system32\cmd.exe
  cmd.exe /c tasklist
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\Windows\system32\cmd.exe
  cmd.exe /c "netsh wlan show profiles"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  cmd.exe /c "arp -a"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    PID:2824
- C:\Windows\system32\cmd.exe
  cmd.exe /c "netstat -ano -p TCP"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\NETSTAT.EXE
    netstat -ano -p TCP
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads