Analysis
-
max time kernel
29s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-03-2021 20:53
Static task
static1
Behavioral task
behavioral1
Sample
599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25.exe
Resource
win7v20201028
General
-
Target
599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25.exe
-
Size
1.9MB
-
MD5
cade87879da9a3f34ddac27afc4351a7
-
SHA1
c9ccb5c6bccbce21414c23e7e62353c9c69ac85c
-
SHA256
599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25
-
SHA512
145e2dc915247c940d535881426766bc461673050795bf9bcc4a6cb74429556f46359ffc7b3695e6cd74f922b003ee5f3c26434482d405164150922df19f21f7
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/496-3-0x0000020B47E70000-0x0000020B47E71000-memory.dmp vmprotect -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.ipify.org 9 api.ipify.org 13 ip-api.com -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25.exepid process 496 599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25.exe 496 599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25.exedescription pid process Token: SeDebugPrivilege 496 599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25.exe"C:\Users\Admin\AppData\Local\Temp\599a3a15aead08fbfb7497550ba8721599d1347364de5e46110b65f074e5ef25.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/496-2-0x00007FF809F60000-0x00007FF80A94C000-memory.dmpFilesize
9.9MB
-
memory/496-3-0x0000020B47E70000-0x0000020B47E71000-memory.dmpFilesize
4KB
-
memory/496-5-0x0000020B48520000-0x0000020B48522000-memory.dmpFilesize
8KB
-
memory/496-6-0x0000020B48470000-0x0000020B48471000-memory.dmpFilesize
4KB
-
memory/496-9-0x0000020B49EA0000-0x0000020B49F11000-memory.dmpFilesize
452KB