Analysis
-
max time kernel
158s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2024 18:30
Behavioral task
behavioral1
Sample
9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
General
-
Target
9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe
-
Size
1.4MB
-
MD5
9da6fd3b6129076a2a7ffaa481ca5cf9
-
SHA1
379bb58bee6bafad8169c47223e946e4bb9cfa0c
-
SHA256
9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a
-
SHA512
18a00a964f7b4e925eb97cd2235ec14cb88f8450a718237fd602bf7c23a5f29ddfa70b285503191fbd5af88a0c15bf37b98fde5b3aef29d75c413548f7e7875a
-
SSDEEP
24576:+xpXPaR2J33o3S7P5zuHHOF2CxfehMHsGKzOYCMEMfX4vZ1fMKeC0:Opy+VDi8rgHfX4vZ9MKeZ
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 3016 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53\Blob = 030000000100000014000000151682f5218c0a511c28f4060a73b9ca78ce9a531400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba972379504000000010000001000000029f1c1b26d92e893b6e6852ab708cce10f00000001000000200000005aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be19000000010000001000000070d4f0bec2078234214bd651643b02405c0000000100000004000000800100001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000640400003082046030820248a0030201020210079e492886376fd40848c23fc631e463300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381e53081e2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b050003820201001b7f252b907a0876007718e1c32e8a364c417ebf174be330d75b0c7e9c96986f7bb068c02444cce2f2fcd1eadbd29f01f9174d0c9d55fda5ad6dd22f3f4b72c02eae73c7251657c23e15ade031d10a84846c6278423122461aed7a40bf9716814477ca6c7b5d215c07f2119121bfe12fc2ef6efd0520e4b4f779f32dbb372af0c6b1acac51f51fb35a1e66ce580718387f71a93c83bad7bc829e9a760f9eb029fdcbf38907481bfeab932e14210d5faf8eb754ab5d0ed45b4c71d092ea3da3369b7c1fe03b55b9d85353cc8366bb4adc810600188bf4b3d748b11341b9c4b69ecf2c778e42200b807e9fc5ab48dbbc6f048d6c4629020d708a1df11273b64624429e2a1718e3acc798c272cc6d2d766ddd2c2b2696a5cf21081be5da2fcbef9f7393aef8365f478f9728ceabe29826988bfdee28322229ed4c9509c420fa07e1862c44f68147c0e46232ed1dd83c488896c35e91b6af7b59a4eee3869cc78858ca282a66559b8580b91dd8402bc91c133ca9ebde99c21640f6f5a4ae2a256c52bac7044cb432bbfc385ca00c617b57ec774e50cfaf06a20f378ce10ed2d32f1abd9c713ecce1f8d1a8a3bd04f619c0f986aff50e1aaa956befca47714b631c4d96db55230a9d0f8175a0e640f56446036ecefa6a7d06eca4340674da53d8b9b8c6237da9f82a2da482a62e2d11cae6cd31587985e6721ca79fd34cd066d0a7bb 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeAssignPrimaryTokenPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeLockMemoryPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeIncreaseQuotaPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeMachineAccountPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeTcbPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeSecurityPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeTakeOwnershipPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeLoadDriverPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeSystemProfilePrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeSystemtimePrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeProfSingleProcessPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeIncBasePriorityPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeCreatePagefilePrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeCreatePermanentPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeBackupPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeRestorePrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeShutdownPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeDebugPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeAuditPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeSystemEnvironmentPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeChangeNotifyPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeRemoteShutdownPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeUndockPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeSyncAgentPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeEnableDelegationPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeManageVolumePrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeImpersonatePrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeCreateGlobalPrivilege 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: 31 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: 32 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: 33 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: 34 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: 35 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe Token: SeDebugPrivilege 3016 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2568 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe 93 PID 2312 wrote to memory of 2568 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe 93 PID 2312 wrote to memory of 2568 2312 9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe 93 PID 2568 wrote to memory of 3016 2568 cmd.exe 97 PID 2568 wrote to memory of 3016 2568 cmd.exe 97 PID 2568 wrote to memory of 3016 2568 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe"C:\Users\Admin\AppData\Local\Temp\9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-