Analysis
-
max time kernel
53s -
max time network
54s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
16-02-2021 17:41
General
-
Target
bb940b97_extracted.exe
-
Size
2.0MB
-
MD5
aa42d84248af944b0947399f4d72267a
-
SHA1
08815276a5efc5c49746fd9a10e6ed32069958d5
-
SHA256
64bfbbdf08aebb66f89866457a931b330968c126c87e8b02f1324392e65a4606
-
SHA512
864c958a0d4277c208dddcee66dc19604480043b213b457042015185e523b0e3219ff022a7df8ad935a16f6557dcb9ad8554092273f382181a6bac59fc90f0c9
Score
10/10
Malware Config
Signatures
-
Parasite, Nexus
Parasite (or Nexus) is an infostealer written in C++.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb940b97_extracted.exe"C:\Users\Admin\AppData\Local\Temp\bb940b97_extracted.exe"1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
-
Filesize
8KB