Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 00:09
Static task
static1
Behavioral task
behavioral1
Sample
875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe
Resource
win10v20201028
General
-
Target
875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe
-
Size
2.1MB
-
MD5
7d805076b1ccffc8a34ca42506dd9a57
-
SHA1
816cb3593b34dd3767b42127fa7c3b4fe76b900d
-
SHA256
875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0
-
SHA512
8de78ae65b1838fa88de346809c3c88f0944cdd866f48f8bfe580225b55a0f06b430c5da47c0e754fb926bc02f8fa3732670ecb2586b4d4647a9c36b53a0d51d
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exedescription pid process Token: SeDebugPrivilege 596 875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/596-2-0x0000000073D40000-0x000000007442E000-memory.dmpFilesize
6.9MB
-
memory/596-3-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/596-5-0x00000000005F0000-0x0000000000643000-memory.dmpFilesize
332KB
-
memory/596-6-0x0000000000810000-0x0000000000861000-memory.dmpFilesize
324KB
-
memory/596-7-0x00000000008C0000-0x000000000090C000-memory.dmpFilesize
304KB
-
memory/596-8-0x0000000002280000-0x00000000022CA000-memory.dmpFilesize
296KB
-
memory/596-9-0x00000000022D0000-0x0000000002318000-memory.dmpFilesize
288KB
-
memory/596-10-0x0000000002320000-0x0000000002365000-memory.dmpFilesize
276KB
-
memory/596-11-0x00000000023F0000-0x0000000002432000-memory.dmpFilesize
264KB
-
memory/596-12-0x0000000000650000-0x000000000068F000-memory.dmpFilesize
252KB
-
memory/596-13-0x0000000000870000-0x00000000008AA000-memory.dmpFilesize
232KB
-
memory/596-14-0x0000000000910000-0x0000000000945000-memory.dmpFilesize
212KB
-
memory/596-15-0x0000000000990000-0x00000000009C3000-memory.dmpFilesize
204KB