Overview

overview

10

Static

static

5c8e4758ca...le.exe

windows7_x64

7

5c8e4758ca...le.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    28-10-2020 14:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c8e4758ca55c7b3f6379d2edccdfd9616517eb420887601115f7736b25e6930.bin.sample.exe

  • Size

    2.3MB

  • MD5

    3fa08a11d59047a429dd90fcc15a6a87

  • SHA1

    60a15cd2a326fd390a80a6056843f3721c33e3ff

  • SHA256

    5c8e4758ca55c7b3f6379d2edccdfd9616517eb420887601115f7736b25e6930

  • SHA512

    6a23ec6be673d9607c080a2e1d35751d0622efc7f27500e5370bfc61fa5361cd2aed4a76e87a0c729f754cd78aa353475cb44b72fbcdfe47f094ce6ec219476a

Score
7/10
spyware

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops file in Program Files directory 5938 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c8e4758ca55c7b3f6379d2edccdfd9616517eb420887601115f7736b25e6930.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\5c8e4758ca55c7b3f6379d2edccdfd9616517eb420887601115f7736b25e6930.bin.sample.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1568
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1232 -s 1436
    1⤵
    • Program crash
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1568-0-0x0000000000400000-0x000000000065F000-memory.dmp
    Filesize

    2.4MB

    Download
  • memory/1568-3-0x0000000002C80000-0x0000000002C91000-memory.dmp
    Filesize

    68KB

    Download
  • memory/1568-2-0x0000000003090000-0x00000000030A1000-memory.dmp
    Filesize

    68KB

    Download
  • memory/1568-1-0x0000000002C80000-0x0000000002C91000-memory.dmp
    Filesize

    68KB

    Download
  • memory/1672-168-0x0000000001F00000-0x0000000001F11000-memory.dmp
    Filesize

    68KB

    Download
  • memory/1672-169-0x0000000002C70000-0x0000000002C81000-memory.dmp
    Filesize

    68KB

    Download