Analysis
-
max time kernel
64s -
max time network
135s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
15-10-2021 21:01
Static task
static1
General
-
Target
21617ddfd6363ea84886402084d346e1d2854ff623c5f2d8b8391715afbea499.exe
-
Size
113KB
-
MD5
ae3f4c6828ce6abe67969a1c9915ab97
-
SHA1
54d1781bb62640487b7b8b38a382d6a0abc21758
-
SHA256
21617ddfd6363ea84886402084d346e1d2854ff623c5f2d8b8391715afbea499
-
SHA512
2db1b8d2acc1da989f2e04de29e92d0095da5646d45e611f5ff5bee828c0709d4f5215e104b861eb0cdde80b79ebda1c3cdb22fc5401159ae4eac11184a6490b
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
21617ddfd6363ea84886402084d346e1d2854ff623c5f2d8b8391715afbea499.exedescription pid process Token: SeDebugPrivilege 3464 21617ddfd6363ea84886402084d346e1d2854ff623c5f2d8b8391715afbea499.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3464-115-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/3464-117-0x0000000005CB0000-0x0000000005CB1000-memory.dmpFilesize
4KB
-
memory/3464-118-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/3464-119-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/3464-120-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/3464-121-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB
-
memory/3464-122-0x00000000056A0000-0x0000000005CA6000-memory.dmpFilesize
6.0MB
-
memory/3464-123-0x0000000006AD0000-0x0000000006AD1000-memory.dmpFilesize
4KB
-
memory/3464-124-0x00000000071D0000-0x00000000071D1000-memory.dmpFilesize
4KB
-
memory/3464-125-0x0000000006D50000-0x0000000006D51000-memory.dmpFilesize
4KB
-
memory/3464-126-0x0000000007C00000-0x0000000007C01000-memory.dmpFilesize
4KB
-
memory/3464-127-0x0000000006FA0000-0x0000000006FA1000-memory.dmpFilesize
4KB
-
memory/3464-128-0x00000000070C0000-0x00000000070C1000-memory.dmpFilesize
4KB
-
memory/3464-129-0x0000000007060000-0x0000000007061000-memory.dmpFilesize
4KB