Analysis
-
max time kernel
58s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18/08/2021, 03:07
Static task
static1
Behavioral task
behavioral1
Sample
RunSomeAware.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
RunSomeAware.exe
-
Size
11KB
-
MD5
defb1faf5a77b823116112dac2e084e2
-
SHA1
423a42138ef0244d18c5502d3af26650521295ed
-
SHA256
df5991f1866b6ba4ca5e6dd81ff50bd4857df9d8eea740850e9abc0f42e15fcd
-
SHA512
5143190d851abe515ebc30e7ac8c096e9a39c9d53de776f950929ac56f8f83bb2147690ba15464558469b4978e3a701031485a588847c27d46d2f44619da2aab
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jre1.8.0_66\lib\ext\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\[email protected] RunSomeAware.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\[email protected] RunSomeAware.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\[email protected] RunSomeAware.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]@gmail.com RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jre1.8.0_66\lib\[email protected] RunSomeAware.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]@gmail.com RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\[email protected] RunSomeAware.exe File created C:\Program Files\7-Zip\Lang\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jre1.8.0_66\lib\ext\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\[email protected] RunSomeAware.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\[email protected] RunSomeAware.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\[email protected] RunSomeAware.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 748 RunSomeAware.exe