Analysis
-
max time kernel
14s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-04-2021 18:03
Static task
static1
Behavioral task
behavioral1
Sample
828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.exe
Resource
win7v20210408
General
-
Target
828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.exe
-
Size
346KB
-
MD5
046d664c5ed7f8bab938bc3709e328c3
-
SHA1
76b7226474b83973c8104ead1743ee9240e42e3d
-
SHA256
828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed
-
SHA512
5629b784bc51695d40f5af3bb0270e601a2692fdeee973841dfbdf14ab28245caba3848d36947dbfbb45e391e5fac0d862a751658e9fae5e7084c0bd48bfaa5c
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1700 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1528 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.execmd.exedescription pid process target process PID 1944 wrote to memory of 1700 1944 828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.exe cmd.exe PID 1944 wrote to memory of 1700 1944 828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.exe cmd.exe PID 1944 wrote to memory of 1700 1944 828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.exe cmd.exe PID 1944 wrote to memory of 1700 1944 828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.exe cmd.exe PID 1700 wrote to memory of 1528 1700 cmd.exe timeout.exe PID 1700 wrote to memory of 1528 1700 cmd.exe timeout.exe PID 1700 wrote to memory of 1528 1700 cmd.exe timeout.exe PID 1700 wrote to memory of 1528 1700 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.exe"C:\Users\Admin\AppData\Local\Temp\828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\828286a465b64587f2cfdb7b10319fca29c9a6b8c6903edc26044edca78e69ed.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1528-64-0x0000000000000000-mapping.dmp
-
memory/1700-63-0x0000000000000000-mapping.dmp
-
memory/1944-60-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB
-
memory/1944-61-0x0000000000220000-0x0000000000258000-memory.dmpFilesize
224KB
-
memory/1944-62-0x0000000000400000-0x0000000002BC7000-memory.dmpFilesize
39.8MB