t35.exe.bin
General
Target
Filesize
Completed
t35.exe.bin.exe
266KB
23-11-2020 19:39
Score
7
/10
MD5
SHA1
SHA256
1db6bd4d13cb9966e8875b3812aef71d
974c46a807d2d680dad5b6d63c38dd0e06e1ed68
9bdbb8dde9ad9be8d9303df1697e13a0f846cca95bc9e41d513c1f5f2a7a37b3
Malware Config
Signatures 10
Filter: none
Collection
Credential Access
Discovery
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Looks up external IP address via web service
Description
Uses a legitimate IP lookup service to find the infected system's external IP.
Reported IOCs
flow ioc 7 api.ipify.org -
Checks SCSI registry key(s)taskmgr.exe
Description
SCSI information is often read in order to detect sandboxing environments.
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registryt35.exe.bin.exe
Description
Processor information is often read in order to detect sandboxing environments.
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 t35.exe.bin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString t35.exe.bin.exe -
Suspicious behavior: EnumeratesProcessest35.exe.bin.exetaskmgr.exe
Reported IOCs
pid process 3980 t35.exe.bin.exe 3980 t35.exe.bin.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe -
Suspicious use of AdjustPrivilegeTokentaskmgr.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 188 taskmgr.exe Token: SeSystemProfilePrivilege 188 taskmgr.exe Token: SeCreateGlobalPrivilege 188 taskmgr.exe Token: 33 188 taskmgr.exe Token: SeIncBasePriorityPrivilege 188 taskmgr.exe -
Suspicious use of FindShellTrayWindowtaskmgr.exe
Reported IOCs
pid process 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe -
Suspicious use of SendNotifyMessagetaskmgr.exe
Reported IOCs
pid process 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe 188 taskmgr.exe
Processes 2
-
C:\Users\Admin\AppData\Local\Temp\t35.exe.bin.exePID:3980"C:\Users\Admin\AppData\Local\Temp\t35.exe.bin.exe"Checks processor information in registrySuspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exePID:188"C:\Windows\system32\taskmgr.exe" /4Checks SCSI registry key(s)Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of FindShellTrayWindowSuspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
Title
Loading Data