Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
19-12-2021 01:51
Behavioral task
behavioral1
Sample
3211d985ee354287b4e9d8c65147004d.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
3211d985ee354287b4e9d8c65147004d.exe
-
Size
106KB
-
MD5
3211d985ee354287b4e9d8c65147004d
-
SHA1
c90a48a6f3ef9b46c3678ea5788f3f3fa7169724
-
SHA256
450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e
-
SHA512
81b85364de8e611fc051a5c4cad2a7821b1d0eee11b2e52cfbb9c45f2b8f43191fb2e9b58f9591a8c43e84140255b777ffb3d23a9a0631dc010d4a5663919ce4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3211d985ee354287b4e9d8c65147004d.exepid process 3932 3211d985ee354287b4e9d8c65147004d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3211d985ee354287b4e9d8c65147004d.exedescription pid process Token: SeDebugPrivilege 3932 3211d985ee354287b4e9d8c65147004d.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3932-115-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/3932-117-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/3932-118-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/3932-119-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/3932-120-0x0000000004EB0000-0x00000000054B6000-memory.dmpFilesize
6.0MB
-
memory/3932-121-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/3932-122-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/3932-123-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/3932-124-0x0000000005AD0000-0x0000000005AD1000-memory.dmpFilesize
4KB
-
memory/3932-125-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/3932-126-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/3932-127-0x0000000005EF0000-0x0000000005EF1000-memory.dmpFilesize
4KB
-
memory/3932-128-0x0000000006840000-0x0000000006841000-memory.dmpFilesize
4KB
-
memory/3932-129-0x0000000006CA0000-0x0000000006CA1000-memory.dmpFilesize
4KB
-
memory/3932-130-0x00000000073A0000-0x00000000073A1000-memory.dmpFilesize
4KB