Analysis
-
max time kernel
146s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-03-2024 20:20
Behavioral task
behavioral1
Sample
SEfFEjMJ.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
-
Target
SEfFEjMJ.exe
-
Size
4.8MB
-
MD5
f72f063babd357ccdc6c346191a305b9
-
SHA1
a7794664194a9087cbf9114d0c33bb88e9ceacc9
-
SHA256
c90d23214088641431d2a93b6e3dfa26e6f5149bc8028449b7ce2f8edb2a6dd3
-
SHA512
5d0af8e363af7d5aa17fd9a8ca0123bfbe45f20dd416830c26ac62a183e6b3bbc1ecceabaedfa1a1ef0c3b1a8abbed7cfbfaa1152395dd0ec9d67cc400617596
-
SSDEEP
98304:NxI7qGEiHBIf+0OgrqA5uillvHsO1733e1pDoEnIVWQd5jZWEFx:nIuGThIfVOgGAIillPsiruDXIwQ/Zx
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/1732-0-0x00007FF719320000-0x00007FF71A19E000-memory.dmp UPX behavioral2/memory/1732-16-0x00007FF719320000-0x00007FF71A19E000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1732-0-0x00007FF719320000-0x00007FF71A19E000-memory.dmp upx behavioral2/memory/1732-16-0x00007FF719320000-0x00007FF71A19E000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2632 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 9 Go-http-client/1.1 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1732 SEfFEjMJ.exe Token: SeIncreaseQuotaPrivilege 1076 wmic.exe Token: SeSecurityPrivilege 1076 wmic.exe Token: SeTakeOwnershipPrivilege 1076 wmic.exe Token: SeLoadDriverPrivilege 1076 wmic.exe Token: SeSystemProfilePrivilege 1076 wmic.exe Token: SeSystemtimePrivilege 1076 wmic.exe Token: SeProfSingleProcessPrivilege 1076 wmic.exe Token: SeIncBasePriorityPrivilege 1076 wmic.exe Token: SeCreatePagefilePrivilege 1076 wmic.exe Token: SeBackupPrivilege 1076 wmic.exe Token: SeRestorePrivilege 1076 wmic.exe Token: SeShutdownPrivilege 1076 wmic.exe Token: SeDebugPrivilege 1076 wmic.exe Token: SeSystemEnvironmentPrivilege 1076 wmic.exe Token: SeRemoteShutdownPrivilege 1076 wmic.exe Token: SeUndockPrivilege 1076 wmic.exe Token: SeManageVolumePrivilege 1076 wmic.exe Token: 33 1076 wmic.exe Token: 34 1076 wmic.exe Token: 35 1076 wmic.exe Token: 36 1076 wmic.exe Token: SeIncreaseQuotaPrivilege 1076 wmic.exe Token: SeSecurityPrivilege 1076 wmic.exe Token: SeTakeOwnershipPrivilege 1076 wmic.exe Token: SeLoadDriverPrivilege 1076 wmic.exe Token: SeSystemProfilePrivilege 1076 wmic.exe Token: SeSystemtimePrivilege 1076 wmic.exe Token: SeProfSingleProcessPrivilege 1076 wmic.exe Token: SeIncBasePriorityPrivilege 1076 wmic.exe Token: SeCreatePagefilePrivilege 1076 wmic.exe Token: SeBackupPrivilege 1076 wmic.exe Token: SeRestorePrivilege 1076 wmic.exe Token: SeShutdownPrivilege 1076 wmic.exe Token: SeDebugPrivilege 1076 wmic.exe Token: SeSystemEnvironmentPrivilege 1076 wmic.exe Token: SeRemoteShutdownPrivilege 1076 wmic.exe Token: SeUndockPrivilege 1076 wmic.exe Token: SeManageVolumePrivilege 1076 wmic.exe Token: 33 1076 wmic.exe Token: 34 1076 wmic.exe Token: 35 1076 wmic.exe Token: 36 1076 wmic.exe Token: SeIncreaseQuotaPrivilege 2632 wmic.exe Token: SeSecurityPrivilege 2632 wmic.exe Token: SeTakeOwnershipPrivilege 2632 wmic.exe Token: SeLoadDriverPrivilege 2632 wmic.exe Token: SeSystemProfilePrivilege 2632 wmic.exe Token: SeSystemtimePrivilege 2632 wmic.exe Token: SeProfSingleProcessPrivilege 2632 wmic.exe Token: SeIncBasePriorityPrivilege 2632 wmic.exe Token: SeCreatePagefilePrivilege 2632 wmic.exe Token: SeBackupPrivilege 2632 wmic.exe Token: SeRestorePrivilege 2632 wmic.exe Token: SeShutdownPrivilege 2632 wmic.exe Token: SeDebugPrivilege 2632 wmic.exe Token: SeSystemEnvironmentPrivilege 2632 wmic.exe Token: SeRemoteShutdownPrivilege 2632 wmic.exe Token: SeUndockPrivilege 2632 wmic.exe Token: SeManageVolumePrivilege 2632 wmic.exe Token: 33 2632 wmic.exe Token: 34 2632 wmic.exe Token: 35 2632 wmic.exe Token: 36 2632 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1076 1732 SEfFEjMJ.exe 89 PID 1732 wrote to memory of 1076 1732 SEfFEjMJ.exe 89 PID 1732 wrote to memory of 2632 1732 SEfFEjMJ.exe 92 PID 1732 wrote to memory of 2632 1732 SEfFEjMJ.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\SEfFEjMJ.exe"C:\Users\Admin\AppData\Local\Temp\SEfFEjMJ.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2632
-