Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-10-2021 06:00
Static task
static1
General
-
Target
494f9643dfbcc2abd56d5adf92531604409ac66a8821aa083ce94f11156d26dc.exe
-
Size
217KB
-
MD5
14c341db18dd8d0d05b8dc2ba13bfc8e
-
SHA1
6daf56acb3becebfbbb4b563f8c4eb0c34f4d718
-
SHA256
494f9643dfbcc2abd56d5adf92531604409ac66a8821aa083ce94f11156d26dc
-
SHA512
02e1d29b8d0d049e4423acf2df811cdc6b0672e81e7e71ae68262e8469c3f837d0134472346f9e8067a8b0240d6b3c02b2c24f9f68a06d40af0877a6bf074067
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
494f9643dfbcc2abd56d5adf92531604409ac66a8821aa083ce94f11156d26dc.exepid process 2720 494f9643dfbcc2abd56d5adf92531604409ac66a8821aa083ce94f11156d26dc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
494f9643dfbcc2abd56d5adf92531604409ac66a8821aa083ce94f11156d26dc.exedescription pid process Token: SeDebugPrivilege 2720 494f9643dfbcc2abd56d5adf92531604409ac66a8821aa083ce94f11156d26dc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\494f9643dfbcc2abd56d5adf92531604409ac66a8821aa083ce94f11156d26dc.exe"C:\Users\Admin\AppData\Local\Temp\494f9643dfbcc2abd56d5adf92531604409ac66a8821aa083ce94f11156d26dc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2720-116-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/2720-118-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/2720-119-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/2720-120-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/2720-121-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/2720-122-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/2720-123-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/2720-124-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/2720-125-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB
-
memory/2720-126-0x0000000006440000-0x0000000006441000-memory.dmpFilesize
4KB
-
memory/2720-127-0x0000000006560000-0x0000000006561000-memory.dmpFilesize
4KB
-
memory/2720-128-0x0000000006B00000-0x0000000006B01000-memory.dmpFilesize
4KB
-
memory/2720-129-0x0000000006540000-0x0000000006541000-memory.dmpFilesize
4KB
-
memory/2720-130-0x0000000007000000-0x0000000007001000-memory.dmpFilesize
4KB
-
memory/2720-131-0x0000000007700000-0x0000000007701000-memory.dmpFilesize
4KB
-
memory/2720-132-0x0000000007520000-0x0000000007521000-memory.dmpFilesize
4KB