Analysis
-
max time kernel
150s -
max time network
78s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 20:38
General
-
Target
New PO #0164522433 JAN 2021.exe
-
Size
1.1MB
-
MD5
1cbe8e5ddca661fc3239ffcb3b44b1db
-
SHA1
1cc2dd369304b5ad81113b06cf7f73c75226cc4e
-
SHA256
8ca38b4cf8849e7b7d18cc8afdae915c4dedc2f5aaca4b9a4fd57bdfd5e25a25
-
SHA512
df833315d49687c0910e92c0f0cba2eefde3657d42b5b6ae7ab2929187d9857c4d45dbba9c253897a18c835c69b4dc44a58cb63f4a29757d75f4e893a81ad558
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New PO #0164522433 JAN 2021.exe"C:\Users\Admin\AppData\Local\Temp\New PO #0164522433 JAN 2021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New PO #0164522433 JAN 2021.exe"C:\Users\Admin\AppData\Local\Temp\New PO #0164522433 JAN 2021.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New PO #0164522433 JAN 2021.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
memory/728-9-0x0000000005A50000-0x0000000005A51000-memory.dmpFilesize
4KB
-
memory/728-11-0x00000000065E0000-0x0000000006652000-memory.dmpFilesize
456KB
-
memory/728-6-0x0000000005D10000-0x0000000005D11000-memory.dmpFilesize
4KB
-
memory/728-7-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/728-8-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/728-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/728-10-0x0000000005880000-0x0000000005892000-memory.dmpFilesize
72KB
-
memory/728-5-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/728-3-0x0000000000DF0000-0x0000000000DF1000-memory.dmpFilesize
4KB
-
memory/2388-13-0x000000000043681E-mapping.dmp
-
memory/2388-12-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2388-15-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/2388-20-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/2388-21-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB