Analysis
-
max time kernel
89s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 04:36
Behavioral task
behavioral1
Sample
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe
-
Size
4.2MB
-
MD5
c9a36a7e0bf431dafe139b1cc18609ed
-
SHA1
4d77f0d31e994d3baeba164238634cadaf95fb77
-
SHA256
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3
-
SHA512
1cdc8cf07dc0b3d83d5f07e1de8bc60a9b5f0f568087f0cc740cc64492eb609e171c4f93eaad37abd9e4f018ed7983f2cdfe991309f6797572d9ee45fa0b8b96
-
SSDEEP
98304:6PSzwcdHYUcyX4eHU0hU/cSuijBf1ULKPQ1w9VOO6GQgjIkU:WS0cJ59U0hUkx6f1g1w9CGQ2I
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/4252-0-0x00007FF7ABC30000-0x00007FF7AC8A8000-memory.dmp UPX behavioral2/memory/4252-16-0x00007FF7ABC30000-0x00007FF7AC8A8000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4252-0-0x00007FF7ABC30000-0x00007FF7AC8A8000-memory.dmp upx behavioral2/memory/4252-16-0x00007FF7ABC30000-0x00007FF7AC8A8000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1188 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 5 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe Token: SeIncreaseQuotaPrivilege 2960 wmic.exe Token: SeSecurityPrivilege 2960 wmic.exe Token: SeTakeOwnershipPrivilege 2960 wmic.exe Token: SeLoadDriverPrivilege 2960 wmic.exe Token: SeSystemProfilePrivilege 2960 wmic.exe Token: SeSystemtimePrivilege 2960 wmic.exe Token: SeProfSingleProcessPrivilege 2960 wmic.exe Token: SeIncBasePriorityPrivilege 2960 wmic.exe Token: SeCreatePagefilePrivilege 2960 wmic.exe Token: SeBackupPrivilege 2960 wmic.exe Token: SeRestorePrivilege 2960 wmic.exe Token: SeShutdownPrivilege 2960 wmic.exe Token: SeDebugPrivilege 2960 wmic.exe Token: SeSystemEnvironmentPrivilege 2960 wmic.exe Token: SeRemoteShutdownPrivilege 2960 wmic.exe Token: SeUndockPrivilege 2960 wmic.exe Token: SeManageVolumePrivilege 2960 wmic.exe Token: 33 2960 wmic.exe Token: 34 2960 wmic.exe Token: 35 2960 wmic.exe Token: 36 2960 wmic.exe Token: SeIncreaseQuotaPrivilege 2960 wmic.exe Token: SeSecurityPrivilege 2960 wmic.exe Token: SeTakeOwnershipPrivilege 2960 wmic.exe Token: SeLoadDriverPrivilege 2960 wmic.exe Token: SeSystemProfilePrivilege 2960 wmic.exe Token: SeSystemtimePrivilege 2960 wmic.exe Token: SeProfSingleProcessPrivilege 2960 wmic.exe Token: SeIncBasePriorityPrivilege 2960 wmic.exe Token: SeCreatePagefilePrivilege 2960 wmic.exe Token: SeBackupPrivilege 2960 wmic.exe Token: SeRestorePrivilege 2960 wmic.exe Token: SeShutdownPrivilege 2960 wmic.exe Token: SeDebugPrivilege 2960 wmic.exe Token: SeSystemEnvironmentPrivilege 2960 wmic.exe Token: SeRemoteShutdownPrivilege 2960 wmic.exe Token: SeUndockPrivilege 2960 wmic.exe Token: SeManageVolumePrivilege 2960 wmic.exe Token: 33 2960 wmic.exe Token: 34 2960 wmic.exe Token: 35 2960 wmic.exe Token: 36 2960 wmic.exe Token: SeIncreaseQuotaPrivilege 1188 wmic.exe Token: SeSecurityPrivilege 1188 wmic.exe Token: SeTakeOwnershipPrivilege 1188 wmic.exe Token: SeLoadDriverPrivilege 1188 wmic.exe Token: SeSystemProfilePrivilege 1188 wmic.exe Token: SeSystemtimePrivilege 1188 wmic.exe Token: SeProfSingleProcessPrivilege 1188 wmic.exe Token: SeIncBasePriorityPrivilege 1188 wmic.exe Token: SeCreatePagefilePrivilege 1188 wmic.exe Token: SeBackupPrivilege 1188 wmic.exe Token: SeRestorePrivilege 1188 wmic.exe Token: SeShutdownPrivilege 1188 wmic.exe Token: SeDebugPrivilege 1188 wmic.exe Token: SeSystemEnvironmentPrivilege 1188 wmic.exe Token: SeRemoteShutdownPrivilege 1188 wmic.exe Token: SeUndockPrivilege 1188 wmic.exe Token: SeManageVolumePrivilege 1188 wmic.exe Token: 33 1188 wmic.exe Token: 34 1188 wmic.exe Token: 35 1188 wmic.exe Token: 36 1188 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4252 wrote to memory of 2960 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 26 PID 4252 wrote to memory of 2960 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 26 PID 4252 wrote to memory of 1188 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 63 PID 4252 wrote to memory of 1188 4252 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 63
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe"C:\Users\Admin\AppData\Local\Temp\7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1188
-