Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-10-2021 06:00
General
-
Target
d01d243cba39311f12c839b9371aa289a9d5a6eb4cc8a783a3923d8de7fa8875.exe
-
Size
264KB
-
MD5
e82d0a2a5460f5808f4e7ee916ac07fa
-
SHA1
6aecfe4826466ad7855ed8ab8fe6a5f3b0244c79
-
SHA256
d01d243cba39311f12c839b9371aa289a9d5a6eb4cc8a783a3923d8de7fa8875
-
SHA512
55885b18aaa0a0994e97e31823da2a781632777b27a1f6b6a9f725eda2c75865e8b31097334b963cc5b9e51fc87b40c8e965650c4df669fd10b6e3a7014ee784
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d01d243cba39311f12c839b9371aa289a9d5a6eb4cc8a783a3923d8de7fa8875.exe"C:\Users\Admin\AppData\Local\Temp\d01d243cba39311f12c839b9371aa289a9d5a6eb4cc8a783a3923d8de7fa8875.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB