218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9

Analysis

max time kernel
8s
max time network
16s
platform
windows7_x64
resource
win7v20210408
submitted
24-08-2021 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a310logger.exe
Size

20KB
MD5

1bad0cbd09b05a21157d8255dc801778
SHA1

ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256

218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512

4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a310logger.exe

pid process

108 a310logger.exe
108 a310logger.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a310logger.exe

description pid process

Token: SeDebugPrivilege 108 a310logger.exe

pid	process
108	a310logger.exe
108	a310logger.exe

description	pid	process
Token: SeDebugPrivilege	108	a310logger.exe

C:\Users\Admin\AppData\Local\Temp\a310logger.exe
"C:\Users\Admin\AppData\Local\Temp\a310logger.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-60-0x0000000001F90000-0x0000000001F92000-memory.dmp

Filesize
8KB

Download