Analysis
-
max time kernel
110s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
10-11-2021 15:55
General
-
Target
2da5e33b3e0a7bf86bbd2e28d6214b10c835d98ebebd0eb1e0f35c195613dc94.exe
-
Size
104KB
-
MD5
17b57e346f1b5eecc8a37dd405eb5b76
-
SHA1
f120c1acd341ceff5e35c8891c007406ff8986bc
-
SHA256
2da5e33b3e0a7bf86bbd2e28d6214b10c835d98ebebd0eb1e0f35c195613dc94
-
SHA512
79c39cad1ca5aad3d568a0e1665ffeea02e546dacbde42132e26944d99caf87dc6f9e5b0db98c9077911d3cb210607a43e12d0b242aec77b2a3755bb588b9208
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2da5e33b3e0a7bf86bbd2e28d6214b10c835d98ebebd0eb1e0f35c195613dc94.exepid process 2432 2da5e33b3e0a7bf86bbd2e28d6214b10c835d98ebebd0eb1e0f35c195613dc94.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2da5e33b3e0a7bf86bbd2e28d6214b10c835d98ebebd0eb1e0f35c195613dc94.exedescription pid process Token: SeDebugPrivilege 2432 2da5e33b3e0a7bf86bbd2e28d6214b10c835d98ebebd0eb1e0f35c195613dc94.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2da5e33b3e0a7bf86bbd2e28d6214b10c835d98ebebd0eb1e0f35c195613dc94.exe"C:\Users\Admin\AppData\Local\Temp\2da5e33b3e0a7bf86bbd2e28d6214b10c835d98ebebd0eb1e0f35c195613dc94.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2432-115-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/2432-117-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/2432-118-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/2432-119-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/2432-120-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/2432-121-0x0000000004E80000-0x0000000005486000-memory.dmpFilesize
6.0MB
-
memory/2432-122-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/2432-123-0x00000000062E0000-0x00000000062E1000-memory.dmpFilesize
4KB
-
memory/2432-124-0x0000000006950000-0x0000000006951000-memory.dmpFilesize
4KB
-
memory/2432-125-0x0000000006530000-0x0000000006531000-memory.dmpFilesize
4KB
-
memory/2432-126-0x0000000006650000-0x0000000006651000-memory.dmpFilesize
4KB
-
memory/2432-127-0x00000000065F0000-0x00000000065F1000-memory.dmpFilesize
4KB
-
memory/2432-128-0x00000000071F0000-0x00000000071F1000-memory.dmpFilesize
4KB
-
memory/2432-129-0x0000000008B70000-0x0000000008B71000-memory.dmpFilesize
4KB
-
memory/2432-130-0x0000000009270000-0x0000000009271000-memory.dmpFilesize
4KB