Overview

overview

7

Static

static

RunSomeAware.exe

windows7_x64

7

RunSomeAware.exe

windows10_x64

7

Analysis

  • max time kernel
    62s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    18-08-2021 03:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RunSomeAware.exe

  • Size

    11KB

  • MD5

    defb1faf5a77b823116112dac2e084e2

  • SHA1

    423a42138ef0244d18c5502d3af26650521295ed

  • SHA256

    df5991f1866b6ba4ca5e6dd81ff50bd4857df9d8eea740850e9abc0f42e15fcd

  • SHA512

    5143190d851abe515ebc30e7ac8c096e9a39c9d53de776f950929ac56f8f83bb2147690ba15464558469b4978e3a701031485a588847c27d46d2f44619da2aab

Score
7/10
spywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RunSomeAware.exe
    "C:\Users\Admin\AppData\Local\Temp\RunSomeAware.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1084
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Urgent Notice.txt
    1⤵
      PID:536

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\Urgent Notice.txt
      MD5

      363ca07e25b1c23951d81294d91708b7

      SHA1

      2216e5eaae1e3275dce4907af4cc9db2f63d4d54

      SHA256

      7cd5765e20f9412da850d5653269446b8f4a3b420b839e8863b9be7252698163

      SHA512

      270489cf37f44b106fcd2c54e15898d5954ca0497b85c8ca3e566f20c8623172d4724d79bf0982b5635e92dbd70639ee7489db575e8f10fd082670cccfcc7254

      Download Submit
    • memory/536-63-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1084-60-0x0000000001350000-0x0000000001351000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1084-62-0x000000001A890000-0x000000001A892000-memory.dmp
      Filesize

      8KB

      Download