Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 04:45
Behavioral task
behavioral1
Sample
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe
-
Size
4.2MB
-
MD5
c9a36a7e0bf431dafe139b1cc18609ed
-
SHA1
4d77f0d31e994d3baeba164238634cadaf95fb77
-
SHA256
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3
-
SHA512
1cdc8cf07dc0b3d83d5f07e1de8bc60a9b5f0f568087f0cc740cc64492eb609e171c4f93eaad37abd9e4f018ed7983f2cdfe991309f6797572d9ee45fa0b8b96
-
SSDEEP
98304:6PSzwcdHYUcyX4eHU0hU/cSuijBf1ULKPQ1w9VOO6GQgjIkU:WS0cJ59U0hUkx6f1g1w9CGQ2I
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/1192-0-0x000000013FEE0000-0x0000000140B58000-memory.dmp UPX behavioral1/memory/1192-10-0x000000013FEE0000-0x0000000140B58000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1192-0-0x000000013FEE0000-0x0000000140B58000-memory.dmp upx behavioral1/memory/1192-10-0x000000013FEE0000-0x0000000140B58000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2884 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 3 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe Token: SeIncreaseQuotaPrivilege 2760 wmic.exe Token: SeSecurityPrivilege 2760 wmic.exe Token: SeTakeOwnershipPrivilege 2760 wmic.exe Token: SeLoadDriverPrivilege 2760 wmic.exe Token: SeSystemProfilePrivilege 2760 wmic.exe Token: SeSystemtimePrivilege 2760 wmic.exe Token: SeProfSingleProcessPrivilege 2760 wmic.exe Token: SeIncBasePriorityPrivilege 2760 wmic.exe Token: SeCreatePagefilePrivilege 2760 wmic.exe Token: SeBackupPrivilege 2760 wmic.exe Token: SeRestorePrivilege 2760 wmic.exe Token: SeShutdownPrivilege 2760 wmic.exe Token: SeDebugPrivilege 2760 wmic.exe Token: SeSystemEnvironmentPrivilege 2760 wmic.exe Token: SeRemoteShutdownPrivilege 2760 wmic.exe Token: SeUndockPrivilege 2760 wmic.exe Token: SeManageVolumePrivilege 2760 wmic.exe Token: 33 2760 wmic.exe Token: 34 2760 wmic.exe Token: 35 2760 wmic.exe Token: SeIncreaseQuotaPrivilege 2760 wmic.exe Token: SeSecurityPrivilege 2760 wmic.exe Token: SeTakeOwnershipPrivilege 2760 wmic.exe Token: SeLoadDriverPrivilege 2760 wmic.exe Token: SeSystemProfilePrivilege 2760 wmic.exe Token: SeSystemtimePrivilege 2760 wmic.exe Token: SeProfSingleProcessPrivilege 2760 wmic.exe Token: SeIncBasePriorityPrivilege 2760 wmic.exe Token: SeCreatePagefilePrivilege 2760 wmic.exe Token: SeBackupPrivilege 2760 wmic.exe Token: SeRestorePrivilege 2760 wmic.exe Token: SeShutdownPrivilege 2760 wmic.exe Token: SeDebugPrivilege 2760 wmic.exe Token: SeSystemEnvironmentPrivilege 2760 wmic.exe Token: SeRemoteShutdownPrivilege 2760 wmic.exe Token: SeUndockPrivilege 2760 wmic.exe Token: SeManageVolumePrivilege 2760 wmic.exe Token: 33 2760 wmic.exe Token: 34 2760 wmic.exe Token: 35 2760 wmic.exe Token: SeIncreaseQuotaPrivilege 2884 wmic.exe Token: SeSecurityPrivilege 2884 wmic.exe Token: SeTakeOwnershipPrivilege 2884 wmic.exe Token: SeLoadDriverPrivilege 2884 wmic.exe Token: SeSystemProfilePrivilege 2884 wmic.exe Token: SeSystemtimePrivilege 2884 wmic.exe Token: SeProfSingleProcessPrivilege 2884 wmic.exe Token: SeIncBasePriorityPrivilege 2884 wmic.exe Token: SeCreatePagefilePrivilege 2884 wmic.exe Token: SeBackupPrivilege 2884 wmic.exe Token: SeRestorePrivilege 2884 wmic.exe Token: SeShutdownPrivilege 2884 wmic.exe Token: SeDebugPrivilege 2884 wmic.exe Token: SeSystemEnvironmentPrivilege 2884 wmic.exe Token: SeRemoteShutdownPrivilege 2884 wmic.exe Token: SeUndockPrivilege 2884 wmic.exe Token: SeManageVolumePrivilege 2884 wmic.exe Token: 33 2884 wmic.exe Token: 34 2884 wmic.exe Token: 35 2884 wmic.exe Token: SeIncreaseQuotaPrivilege 2884 wmic.exe Token: SeSecurityPrivilege 2884 wmic.exe Token: SeTakeOwnershipPrivilege 2884 wmic.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1192 wrote to memory of 2760 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 29 PID 1192 wrote to memory of 2760 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 29 PID 1192 wrote to memory of 2760 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 29 PID 1192 wrote to memory of 2884 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 31 PID 1192 wrote to memory of 2884 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 31 PID 1192 wrote to memory of 2884 1192 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe"C:\Users\Admin\AppData\Local\Temp\7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2884
-