Overview

overview

7

Static

static

RunSomeAware.exe

windows7_x64

7

RunSomeAware.exe

windows10_x64

7

Analysis

  • max time kernel
    58s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    18-08-2021 03:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RunSomeAware.exe

  • Size

    11KB

  • MD5

    defb1faf5a77b823116112dac2e084e2

  • SHA1

    423a42138ef0244d18c5502d3af26650521295ed

  • SHA256

    df5991f1866b6ba4ca5e6dd81ff50bd4857df9d8eea740850e9abc0f42e15fcd

  • SHA512

    5143190d851abe515ebc30e7ac8c096e9a39c9d53de776f950929ac56f8f83bb2147690ba15464558469b4978e3a701031485a588847c27d46d2f44619da2aab

Score
7/10
spywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RunSomeAware.exe
    "C:\Users\Admin\AppData\Local\Temp\RunSomeAware.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/748-114-0x0000000000E00000-0x0000000000E01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/748-116-0x000000001BAA0000-0x000000001BAA2000-memory.dmp
    Filesize

    8KB

    Download