bba9c79625e584f537b28492801b0d073408b2876a8500285205c99a2c0e8261

Analysis

max time kernel
76s
max time network
125s
platform
windows10_x64
resource
win10-en-20211014
submitted
20-10-2021 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

119KB
MD5

5fa26e5f727057a355a57253b451f1c2
SHA1

905fa3e581f8b2b4e7a025851bf75fd1d506313a
SHA256

bba9c79625e584f537b28492801b0d073408b2876a8500285205c99a2c0e8261
SHA512

2ca57d69a6b538fc18de911f7e493d4190002f3bb5d5fb74efc57e0d9b60ec967c45cdc02c5f91a2af4c3104053898076da190ed53b515e78122e7f7a0bb0026

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Setup.exe

pid process

1872 Setup.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Setup.exe

description pid process

Token: SeDebugPrivilege 1872 Setup.exe

pid	process
1872	Setup.exe

description	pid	process
Token: SeDebugPrivilege	1872	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-115-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/1872-117-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/1872-118-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/1872-119-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/1872-120-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/1872-121-0x00000000050E0000-0x00000000056E6000-memory.dmp

Filesize
6.0MB

Download
memory/1872-122-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/1872-123-0x0000000006690000-0x0000000006691000-memory.dmp

Filesize
4KB

Download
memory/1872-124-0x0000000006D90000-0x0000000006D91000-memory.dmp

Filesize
4KB

Download
memory/1872-125-0x0000000006860000-0x0000000006861000-memory.dmp

Filesize
4KB

Download
memory/1872-126-0x00000000077C0000-0x00000000077C1000-memory.dmp

Filesize
4KB

Download
memory/1872-127-0x0000000006A80000-0x0000000006A81000-memory.dmp

Filesize
4KB

Download
memory/1872-128-0x0000000006BA0000-0x0000000006BA1000-memory.dmp

Filesize
4KB

Download
memory/1872-129-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/1872-130-0x00000000074B0000-0x00000000074B1000-memory.dmp

Filesize
4KB

Download