Analysis
-
max time kernel
110s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
22-10-2021 18:18
Static task
static1
General
-
Target
ffb2605674ae69ecb24d0c3614117e7a3c8207b985d66330a6e6b656d44a175a.exe
-
Size
217KB
-
MD5
19089d8f5fb2ce7b4615059cba246b22
-
SHA1
f2c143e5351a6900a2cecca9e89346610ca27be5
-
SHA256
ffb2605674ae69ecb24d0c3614117e7a3c8207b985d66330a6e6b656d44a175a
-
SHA512
9162ec7d494327bbf5ddbf977d1a5a7910dfeeab7c7e509237ba9be66bcf25a9f9961190133b44eecf55ff547a25954342ce2eed4c2866c2fe0bc6c3136bbb7c
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ffb2605674ae69ecb24d0c3614117e7a3c8207b985d66330a6e6b656d44a175a.exepid process 1000 ffb2605674ae69ecb24d0c3614117e7a3c8207b985d66330a6e6b656d44a175a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ffb2605674ae69ecb24d0c3614117e7a3c8207b985d66330a6e6b656d44a175a.exedescription pid process Token: SeDebugPrivilege 1000 ffb2605674ae69ecb24d0c3614117e7a3c8207b985d66330a6e6b656d44a175a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffb2605674ae69ecb24d0c3614117e7a3c8207b985d66330a6e6b656d44a175a.exe"C:\Users\Admin\AppData\Local\Temp\ffb2605674ae69ecb24d0c3614117e7a3c8207b985d66330a6e6b656d44a175a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1000-115-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB
-
memory/1000-117-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/1000-118-0x0000000002BA0000-0x0000000002BA1000-memory.dmpFilesize
4KB
-
memory/1000-119-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/1000-120-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/1000-121-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/1000-122-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/1000-123-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/1000-124-0x0000000006570000-0x0000000006571000-memory.dmpFilesize
4KB
-
memory/1000-125-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/1000-126-0x00000000061F0000-0x00000000061F1000-memory.dmpFilesize
4KB
-
memory/1000-127-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1000-128-0x00000000062B0000-0x00000000062B1000-memory.dmpFilesize
4KB
-
memory/1000-129-0x00000000064F0000-0x00000000064F1000-memory.dmpFilesize
4KB
-
memory/1000-130-0x0000000006FD0000-0x0000000006FD1000-memory.dmpFilesize
4KB
-
memory/1000-131-0x0000000007DE0000-0x0000000007DE1000-memory.dmpFilesize
4KB