Analysis
-
max time kernel
88s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14-02-2024 05:44
Behavioral task
behavioral1
Sample
beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe
-
Size
4.2MB
-
MD5
83741e7578d11053fd5cbbf15ed253b3
-
SHA1
e95948bdfcf0355afc81e913caeb319b7fb1318c
-
SHA256
beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5
-
SHA512
c4bc5ddbd48e950b4175d799b08308ded0e720a24db39431dada81692eae87018b0e281c1ddb8dbf2bba5e66c4160db8cd471e8e03febe3ac786f59f6ece7706
-
SSDEEP
98304:x4RhOygpdPL0UH+TI8zm/tlF2IREpF9MBeE7eUxhx1u:uRhDw+IWQtD2ldJG
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2588-0-0x00007FF7C4700000-0x00007FF7C5378000-memory.dmp UPX behavioral2/memory/2588-16-0x00007FF7C4700000-0x00007FF7C5378000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2588-0-0x00007FF7C4700000-0x00007FF7C5378000-memory.dmp upx behavioral2/memory/2588-16-0x00007FF7C4700000-0x00007FF7C5378000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 6 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exepid Process 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exewmic.exewmic.exedescription pid Process Token: SeDebugPrivilege 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe Token: SeIncreaseQuotaPrivilege 900 wmic.exe Token: SeSecurityPrivilege 900 wmic.exe Token: SeTakeOwnershipPrivilege 900 wmic.exe Token: SeLoadDriverPrivilege 900 wmic.exe Token: SeSystemProfilePrivilege 900 wmic.exe Token: SeSystemtimePrivilege 900 wmic.exe Token: SeProfSingleProcessPrivilege 900 wmic.exe Token: SeIncBasePriorityPrivilege 900 wmic.exe Token: SeCreatePagefilePrivilege 900 wmic.exe Token: SeBackupPrivilege 900 wmic.exe Token: SeRestorePrivilege 900 wmic.exe Token: SeShutdownPrivilege 900 wmic.exe Token: SeDebugPrivilege 900 wmic.exe Token: SeSystemEnvironmentPrivilege 900 wmic.exe Token: SeRemoteShutdownPrivilege 900 wmic.exe Token: SeUndockPrivilege 900 wmic.exe Token: SeManageVolumePrivilege 900 wmic.exe Token: 33 900 wmic.exe Token: 34 900 wmic.exe Token: 35 900 wmic.exe Token: 36 900 wmic.exe Token: SeIncreaseQuotaPrivilege 900 wmic.exe Token: SeSecurityPrivilege 900 wmic.exe Token: SeTakeOwnershipPrivilege 900 wmic.exe Token: SeLoadDriverPrivilege 900 wmic.exe Token: SeSystemProfilePrivilege 900 wmic.exe Token: SeSystemtimePrivilege 900 wmic.exe Token: SeProfSingleProcessPrivilege 900 wmic.exe Token: SeIncBasePriorityPrivilege 900 wmic.exe Token: SeCreatePagefilePrivilege 900 wmic.exe Token: SeBackupPrivilege 900 wmic.exe Token: SeRestorePrivilege 900 wmic.exe Token: SeShutdownPrivilege 900 wmic.exe Token: SeDebugPrivilege 900 wmic.exe Token: SeSystemEnvironmentPrivilege 900 wmic.exe Token: SeRemoteShutdownPrivilege 900 wmic.exe Token: SeUndockPrivilege 900 wmic.exe Token: SeManageVolumePrivilege 900 wmic.exe Token: 33 900 wmic.exe Token: 34 900 wmic.exe Token: 35 900 wmic.exe Token: 36 900 wmic.exe Token: SeIncreaseQuotaPrivilege 2224 wmic.exe Token: SeSecurityPrivilege 2224 wmic.exe Token: SeTakeOwnershipPrivilege 2224 wmic.exe Token: SeLoadDriverPrivilege 2224 wmic.exe Token: SeSystemProfilePrivilege 2224 wmic.exe Token: SeSystemtimePrivilege 2224 wmic.exe Token: SeProfSingleProcessPrivilege 2224 wmic.exe Token: SeIncBasePriorityPrivilege 2224 wmic.exe Token: SeCreatePagefilePrivilege 2224 wmic.exe Token: SeBackupPrivilege 2224 wmic.exe Token: SeRestorePrivilege 2224 wmic.exe Token: SeShutdownPrivilege 2224 wmic.exe Token: SeDebugPrivilege 2224 wmic.exe Token: SeSystemEnvironmentPrivilege 2224 wmic.exe Token: SeRemoteShutdownPrivilege 2224 wmic.exe Token: SeUndockPrivilege 2224 wmic.exe Token: SeManageVolumePrivilege 2224 wmic.exe Token: 33 2224 wmic.exe Token: 34 2224 wmic.exe Token: 35 2224 wmic.exe Token: 36 2224 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exedescription pid Process procid_target PID 2588 wrote to memory of 900 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 87 PID 2588 wrote to memory of 900 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 87 PID 2588 wrote to memory of 2224 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 89 PID 2588 wrote to memory of 2224 2588 beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe"C:\Users\Admin\AppData\Local\Temp\beb1e444d4a7e27ca6cb5fe55e9eaa3ecf880c044755d72f7724e7fea8371cd5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:900
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2224
-