Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 19:43
Behavioral task
behavioral1
Sample
4cd16507a31ada721884ccaa2f8e95f1.exe
Resource
win7v20210408
0 signatures
0 seconds
General
-
Target
4cd16507a31ada721884ccaa2f8e95f1.exe
-
Size
116KB
-
MD5
4cd16507a31ada721884ccaa2f8e95f1
-
SHA1
b2a8d765c17264c3ba0d1510955d3b9fce6dd574
-
SHA256
3d43207b1a548897c03fecb53ee1f988ff3f8ddc19418eb13eae6c7eba1957cf
-
SHA512
ea9f723006506c3872240e2f5fb63fd827baad6dd07d8a0576b8906560948f852c7c39486dd83d1a49e95491a31fa33e61bd6ac768becc40e73bd29fec464bca
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4cd16507a31ada721884ccaa2f8e95f1.exepid process 2168 4cd16507a31ada721884ccaa2f8e95f1.exe 2168 4cd16507a31ada721884ccaa2f8e95f1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4cd16507a31ada721884ccaa2f8e95f1.exedescription pid process Token: SeDebugPrivilege 2168 4cd16507a31ada721884ccaa2f8e95f1.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2168-115-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/2168-117-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/2168-118-0x0000000002FB0000-0x0000000002FB1000-memory.dmpFilesize
4KB
-
memory/2168-119-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/2168-120-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2168-121-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/2168-122-0x0000000003160000-0x0000000003161000-memory.dmpFilesize
4KB
-
memory/2168-123-0x0000000006DA0000-0x0000000006DA1000-memory.dmpFilesize
4KB
-
memory/2168-124-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/2168-125-0x0000000007010000-0x0000000007011000-memory.dmpFilesize
4KB
-
memory/2168-126-0x0000000007130000-0x0000000007131000-memory.dmpFilesize
4KB
-
memory/2168-127-0x0000000007ED0000-0x0000000007ED1000-memory.dmpFilesize
4KB
-
memory/2168-128-0x00000000071F0000-0x00000000071F1000-memory.dmpFilesize
4KB
-
memory/2168-129-0x0000000007AD0000-0x0000000007AD1000-memory.dmpFilesize
4KB
-
memory/2168-130-0x0000000007300000-0x0000000007301000-memory.dmpFilesize
4KB