Analysis
- max time kernel
73s - max time network
77s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/10/2021, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe
- Size 16.5MB
- Sample211006-nvj7wabcgm
- SHA256 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8
- MD5 79abb39081305740a833146200d0228c
- SHA1 2c47253e48f53e3f7c782ff05cb6355173bb3c89
- SHA512 47dba569af8237a805143ce833870abb07cac2fc06f39959a6bf5f6f8622993a6aee0eff912ac931d8d0302b1273d27660d9a4ca5507a2aa673e1a392a594a5a
- MD5 SHA1 SHA512
Malware Config
Signatures
- Loads dropped DLL 41 IoCs
pid Process 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 1140 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 992 wrote to memory of 1140 992 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 69 PID 992 wrote to memory of 1140 992 4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe"C:\Users\Admin\AppData\Local\Temp\4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe"C:\Users\Admin\AppData\Local\Temp\4a70b909dbe668d0d2c5241dc582acb90c8820acb436a1ecbb620019e93fbda8.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1140
-