Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14-02-2024 05:44
Behavioral task
behavioral1
Sample
beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe
-
Size
4.2MB
-
MD5
83741e7578d11053fd5cbbf15ed253b3
-
SHA1
e95948bdfcf0355afc81e913caeb319b7fb1318c
-
SHA256
beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5
-
SHA512
c4bc5ddbd48e950b4175d799b08308ded0e720a24db39431dada81692eae87018b0e281c1ddb8dbf2bba5e66c4160db8cd471e8e03febe3ac786f59f6ece7706
-
SSDEEP
98304:x4RhOygpdPL0UH+TI8zm/tlF2IREpF9MBeE7eUxhx1u:uRhDw+IWQtD2ldJG
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/2364-0-0x000000013F180000-0x000000013FDF8000-memory.dmp UPX behavioral1/memory/2364-10-0x000000013F180000-0x000000013FDF8000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2364-0-0x000000013F180000-0x000000013FDF8000-memory.dmp upx behavioral1/memory/2364-10-0x000000013F180000-0x000000013FDF8000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2696 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 3 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe Token: SeIncreaseQuotaPrivilege 2692 wmic.exe Token: SeSecurityPrivilege 2692 wmic.exe Token: SeTakeOwnershipPrivilege 2692 wmic.exe Token: SeLoadDriverPrivilege 2692 wmic.exe Token: SeSystemProfilePrivilege 2692 wmic.exe Token: SeSystemtimePrivilege 2692 wmic.exe Token: SeProfSingleProcessPrivilege 2692 wmic.exe Token: SeIncBasePriorityPrivilege 2692 wmic.exe Token: SeCreatePagefilePrivilege 2692 wmic.exe Token: SeBackupPrivilege 2692 wmic.exe Token: SeRestorePrivilege 2692 wmic.exe Token: SeShutdownPrivilege 2692 wmic.exe Token: SeDebugPrivilege 2692 wmic.exe Token: SeSystemEnvironmentPrivilege 2692 wmic.exe Token: SeRemoteShutdownPrivilege 2692 wmic.exe Token: SeUndockPrivilege 2692 wmic.exe Token: SeManageVolumePrivilege 2692 wmic.exe Token: 33 2692 wmic.exe Token: 34 2692 wmic.exe Token: 35 2692 wmic.exe Token: SeIncreaseQuotaPrivilege 2692 wmic.exe Token: SeSecurityPrivilege 2692 wmic.exe Token: SeTakeOwnershipPrivilege 2692 wmic.exe Token: SeLoadDriverPrivilege 2692 wmic.exe Token: SeSystemProfilePrivilege 2692 wmic.exe Token: SeSystemtimePrivilege 2692 wmic.exe Token: SeProfSingleProcessPrivilege 2692 wmic.exe Token: SeIncBasePriorityPrivilege 2692 wmic.exe Token: SeCreatePagefilePrivilege 2692 wmic.exe Token: SeBackupPrivilege 2692 wmic.exe Token: SeRestorePrivilege 2692 wmic.exe Token: SeShutdownPrivilege 2692 wmic.exe Token: SeDebugPrivilege 2692 wmic.exe Token: SeSystemEnvironmentPrivilege 2692 wmic.exe Token: SeRemoteShutdownPrivilege 2692 wmic.exe Token: SeUndockPrivilege 2692 wmic.exe Token: SeManageVolumePrivilege 2692 wmic.exe Token: 33 2692 wmic.exe Token: 34 2692 wmic.exe Token: 35 2692 wmic.exe Token: SeIncreaseQuotaPrivilege 2696 wmic.exe Token: SeSecurityPrivilege 2696 wmic.exe Token: SeTakeOwnershipPrivilege 2696 wmic.exe Token: SeLoadDriverPrivilege 2696 wmic.exe Token: SeSystemProfilePrivilege 2696 wmic.exe Token: SeSystemtimePrivilege 2696 wmic.exe Token: SeProfSingleProcessPrivilege 2696 wmic.exe Token: SeIncBasePriorityPrivilege 2696 wmic.exe Token: SeCreatePagefilePrivilege 2696 wmic.exe Token: SeBackupPrivilege 2696 wmic.exe Token: SeRestorePrivilege 2696 wmic.exe Token: SeShutdownPrivilege 2696 wmic.exe Token: SeDebugPrivilege 2696 wmic.exe Token: SeSystemEnvironmentPrivilege 2696 wmic.exe Token: SeRemoteShutdownPrivilege 2696 wmic.exe Token: SeUndockPrivilege 2696 wmic.exe Token: SeManageVolumePrivilege 2696 wmic.exe Token: 33 2696 wmic.exe Token: 34 2696 wmic.exe Token: 35 2696 wmic.exe Token: SeIncreaseQuotaPrivilege 2696 wmic.exe Token: SeSecurityPrivilege 2696 wmic.exe Token: SeTakeOwnershipPrivilege 2696 wmic.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2692 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 29 PID 2364 wrote to memory of 2692 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 29 PID 2364 wrote to memory of 2692 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 29 PID 2364 wrote to memory of 2696 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 31 PID 2364 wrote to memory of 2696 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 31 PID 2364 wrote to memory of 2696 2364 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe"C:\Users\Admin\AppData\Local\Temp\beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2696
-