Analysis
- max time kernel
144s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
05/03/2024, 02:53
Behavioral task
behavioral1
Sample
e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
- Target e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db.exe
- Size 4.8MB
- Sample240305-ddkf7scf81
- SHA256 e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db
- MD5 f364d1b15bb2049549d9084496ad239b
- SHA1 adbe8eb29c5e442a8515ba9c63a62126427ada8e
- SHA512 e94de32df4aebade28b24ba7007db2e002714b721e788de70f1f4080c72133742452b076da03530547cb18cea3d1c0cda84417d49810069076020b9fc610346f
- SSDEEP 98304:GL4AFoEMQEbPjwV/xQzp2FMhsTBfkIS2oFw5gmpp4k:26EMnb7kZw4FMaTRkItym
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/3356-0-0x00007FF652C00000-0x00007FF653A82000-memory.dmp UPX behavioral2/memory/3356-16-0x00007FF652C00000-0x00007FF653A82000-memory.dmp UPX - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3356-0-0x00007FF652C00000-0x00007FF653A82000-memory.dmp upx behavioral2/memory/3356-16-0x00007FF652C00000-0x00007FF653A82000-memory.dmp upx - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ipinfo.io - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2600 wmic.exe - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 8 Go-http-client/1.1 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3356 e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db.exe Token: SeIncreaseQuotaPrivilege 4632 wmic.exe Token: SeSecurityPrivilege 4632 wmic.exe Token: SeTakeOwnershipPrivilege 4632 wmic.exe Token: SeLoadDriverPrivilege 4632 wmic.exe Token: SeSystemProfilePrivilege 4632 wmic.exe Token: SeSystemtimePrivilege 4632 wmic.exe Token: SeProfSingleProcessPrivilege 4632 wmic.exe Token: SeIncBasePriorityPrivilege 4632 wmic.exe Token: SeCreatePagefilePrivilege 4632 wmic.exe Token: SeBackupPrivilege 4632 wmic.exe Token: SeRestorePrivilege 4632 wmic.exe Token: SeShutdownPrivilege 4632 wmic.exe Token: SeDebugPrivilege 4632 wmic.exe Token: SeSystemEnvironmentPrivilege 4632 wmic.exe Token: SeRemoteShutdownPrivilege 4632 wmic.exe Token: SeUndockPrivilege 4632 wmic.exe Token: SeManageVolumePrivilege 4632 wmic.exe Token: 33 4632 wmic.exe Token: 34 4632 wmic.exe Token: 35 4632 wmic.exe Token: 36 4632 wmic.exe Token: SeIncreaseQuotaPrivilege 4632 wmic.exe Token: SeSecurityPrivilege 4632 wmic.exe Token: SeTakeOwnershipPrivilege 4632 wmic.exe Token: SeLoadDriverPrivilege 4632 wmic.exe Token: SeSystemProfilePrivilege 4632 wmic.exe Token: SeSystemtimePrivilege 4632 wmic.exe Token: SeProfSingleProcessPrivilege 4632 wmic.exe Token: SeIncBasePriorityPrivilege 4632 wmic.exe Token: SeCreatePagefilePrivilege 4632 wmic.exe Token: SeBackupPrivilege 4632 wmic.exe Token: SeRestorePrivilege 4632 wmic.exe Token: SeShutdownPrivilege 4632 wmic.exe Token: SeDebugPrivilege 4632 wmic.exe Token: SeSystemEnvironmentPrivilege 4632 wmic.exe Token: SeRemoteShutdownPrivilege 4632 wmic.exe Token: SeUndockPrivilege 4632 wmic.exe Token: SeManageVolumePrivilege 4632 wmic.exe Token: 33 4632 wmic.exe Token: 34 4632 wmic.exe Token: 35 4632 wmic.exe Token: 36 4632 wmic.exe Token: SeIncreaseQuotaPrivilege 2600 wmic.exe Token: SeSecurityPrivilege 2600 wmic.exe Token: SeTakeOwnershipPrivilege 2600 wmic.exe Token: SeLoadDriverPrivilege 2600 wmic.exe Token: SeSystemProfilePrivilege 2600 wmic.exe Token: SeSystemtimePrivilege 2600 wmic.exe Token: SeProfSingleProcessPrivilege 2600 wmic.exe Token: SeIncBasePriorityPrivilege 2600 wmic.exe Token: SeCreatePagefilePrivilege 2600 wmic.exe Token: SeBackupPrivilege 2600 wmic.exe Token: SeRestorePrivilege 2600 wmic.exe Token: SeShutdownPrivilege 2600 wmic.exe Token: SeDebugPrivilege 2600 wmic.exe Token: SeSystemEnvironmentPrivilege 2600 wmic.exe Token: SeRemoteShutdownPrivilege 2600 wmic.exe Token: SeUndockPrivilege 2600 wmic.exe Token: SeManageVolumePrivilege 2600 wmic.exe Token: 33 2600 wmic.exe Token: 34 2600 wmic.exe Token: 35 2600 wmic.exe Token: 36 2600 wmic.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3356 wrote to memory of 4632 3356 e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db.exe 89 PID 3356 wrote to memory of 4632 3356 e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db.exe 89 PID 3356 wrote to memory of 2600 3356 e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db.exe 92 PID 3356 wrote to memory of 2600 3356 e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db.exe"C:\Users\Admin\AppData\Local\Temp\e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2600
-