Analysis
- max time kernel
23s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/02/2021, 13:11
General
- Target 4896f74ee4f4b2a732b992be8ea295c4.exe
- Size 268KB
- Sample210211-qsvsj6hkps
- SHA256 808be962b671de3c658a363c3ca14ea5181d3669f0a23f0263a175e9416daab5
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4896f74ee4f4b2a732b992be8ea295c4.exe"C:\Users\Admin\AppData\Local\Temp\4896f74ee4f4b2a732b992be8ea295c4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/640-2-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/640-3-0x0000000000D50000-0x0000000000D87000-memory.dmp
memory/640-4-0x0000000002A10000-0x0000000002A11000-memory.dmp
memory/640-5-0x0000000073060000-0x000000007374E000-memory.dmp
memory/640-6-0x0000000000400000-0x000000000043A000-memory.dmp
memory/640-7-0x00000000028D0000-0x00000000028FE000-memory.dmp
memory/640-8-0x0000000005000000-0x0000000005001000-memory.dmp
memory/640-10-0x00000000028C2000-0x00000000028C3000-memory.dmp
memory/640-9-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/640-11-0x00000000028C3000-0x00000000028C4000-memory.dmp
memory/640-12-0x0000000002B50000-0x0000000002B7C000-memory.dmp
memory/640-13-0x0000000005500000-0x0000000005501000-memory.dmp
memory/640-14-0x0000000005580000-0x0000000005581000-memory.dmp
memory/640-15-0x00000000028C4000-0x00000000028C6000-memory.dmp
memory/640-16-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/640-17-0x0000000005C90000-0x0000000005C91000-memory.dmp
memory/640-18-0x0000000005CB0000-0x0000000005CB1000-memory.dmp
memory/640-19-0x0000000005E20000-0x0000000005E21000-memory.dmp
memory/640-20-0x0000000005FA0000-0x0000000005FA1000-memory.dmp
memory/640-21-0x0000000006B70000-0x0000000006B71000-memory.dmp
memory/640-22-0x0000000006D50000-0x0000000006D51000-memory.dmp
memory/640-23-0x0000000007390000-0x0000000007391000-memory.dmp
memory/640-24-0x0000000007440000-0x0000000007441000-memory.dmp
memory/640-25-0x0000000007C70000-0x0000000007C71000-memory.dmp