98bf522cda546fe43ae451c9c52140fa173473684ea5287cf2717e26eb66e83b | Triage™

Analysis

max time kernel
109s
max time network
132s
platform
windows10_x64
resource
win10v200430
submitted
10/07/2020, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.PWS.Stealer.27776.22188.13961.exe
Size 28KB
Sample200710-qs2e9t5egs
SHA256 98bf522cda546fe43ae451c9c52140fa173473684ea5287cf2717e26eb66e83b
MD5 4bab1c8635f10d4281b56d862e3096eb
SHA1 991880dcd215a8d92f322e38d56aaa149ae72886
SHA512 7cc1829738a9fdb8cbea7bbb24e66b7c248b1968b58b4b350b06bd741bee9fffde79e875fa87d93f2f89516ef39e9c1e44d3bedd07135d70f14425bd12a25c51
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	SecuriteInfo.com.Trojan.PWS.Stealer.27776.22188.13961.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.27776.22188.13961.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.27776.22188.13961.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads