Analysis
-
max time kernel
132s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-11-2020 11:08
Static task
static1
Behavioral task
behavioral1
Sample
bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe
Resource
win7v20201028
General
-
Target
bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe
-
Size
105KB
-
MD5
e4c0c4bf65b7c4d66cd8c90db3a88f8e
-
SHA1
ca70eeada3608c95a734ab029d6d268b741b7be9
-
SHA256
bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186
-
SHA512
95967d0021f067b1455555e4ef13fa586a59c86985c24d28d2b2818d388b2f98c74f6e33152900c8437dcc6b3d9261eb66735656fe30bf5e854191a2ce3e7dcd
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exedescription pid process Token: SeImpersonatePrivilege 912 bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe Token: SeTcbPrivilege 912 bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe Token: SeChangeNotifyPrivilege 912 bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe Token: SeCreateTokenPrivilege 912 bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe Token: SeBackupPrivilege 912 bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe Token: SeRestorePrivilege 912 bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe Token: SeIncreaseQuotaPrivilege 912 bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe Token: SeAssignPrimaryTokenPrivilege 912 bae5ff08fefa9164c7f76bc778085f484cda975a10d62e882d487bb78d18a186.exe