81967adfc60e1b5895f81d7bc1d1fdcb000f451a1524d56f831f43232b6841ff

Analysis

max time kernel
86s
max time network
75s
platform
windows7_x64
resource
win7
submitted
08/07/2020, 06:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7599525244gZ.exe
Size 883KB
Sample200708-nfqdctl1ge
SHA256 81967adfc60e1b5895f81d7bc1d1fdcb000f451a1524d56f831f43232b6841ff
MD5 89f79b70ca375bcf96333974bac723f0
SHA1 ce93da121de90a87a93b09a98f2d3564afe75079
SHA512 e709a0b0ea790dc0b8bbed49d037cf18ce62f068b4fca480f5d8eccf9bd8a1aa9d84847a55a10695a7436dca4e6f253682695660c2ac4eab9b1cd4a7c5ecc982
MD5 SHA1 SHA512

Score

7^/10

spyware

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1428	1088	7599525244gZ.exe	24
PID 1088 wrote to memory of 1428	1088	7599525244gZ.exe	24
PID 1088 wrote to memory of 1428	1088	7599525244gZ.exe	24
PID 1088 wrote to memory of 1428	1088	7599525244gZ.exe	24
PID 1088 wrote to memory of 1428	1088	7599525244gZ.exe	24
PID 1088 wrote to memory of 1428	1088	7599525244gZ.exe	24
PID 1088 wrote to memory of 1428	1088	7599525244gZ.exe	24
PID 1088 wrote to memory of 1428	1088	7599525244gZ.exe	24
PID 1088 wrote to memory of 1428	1088	7599525244gZ.exe	24

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 1428	1088	7599525244gZ.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	7599525244gZ.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1428	7599525244gZ.exe
1428	7599525244gZ.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\7599525244gZ.exe
"C:\Users\Admin\AppData\Local\Temp\7599525244gZ.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1088
- C:\Users\Admin\AppData\Local\Temp\7599525244gZ.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-2-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/1428-4-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/1428-5-0x0000000000400000-0x000000000044A000-memory.dmp

Download