Analysis
- max time kernel
26s - max time network
28s - platform
windows7_x64 - resource
win7v20201028 - submitted
11/02/2021, 13:11
General
- Target 4896f74ee4f4b2a732b992be8ea295c4.exe
- Size 268KB
- Sample210211-qsvsj6hkps
- SHA256 808be962b671de3c658a363c3ca14ea5181d3669f0a23f0263a175e9416daab5
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4896f74ee4f4b2a732b992be8ea295c4.exe"C:\Users\Admin\AppData\Local\Temp\4896f74ee4f4b2a732b992be8ea295c4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1888-2-0x0000000000BF0000-0x0000000000C01000-memory.dmp
memory/1888-3-0x0000000002490000-0x00000000024A1000-memory.dmp
memory/1888-4-0x00000000742A0000-0x000000007498E000-memory.dmp
memory/1888-6-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1888-5-0x0000000000230000-0x0000000000267000-memory.dmp
memory/1888-7-0x0000000002410000-0x000000000243E000-memory.dmp
memory/1888-13-0x0000000002530000-0x000000000255C000-memory.dmp
memory/1888-16-0x0000000002443000-0x0000000002444000-memory.dmp
memory/1888-15-0x0000000002442000-0x0000000002443000-memory.dmp
memory/1888-17-0x0000000002444000-0x0000000002446000-memory.dmp
memory/1888-14-0x0000000002441000-0x0000000002442000-memory.dmp