Analysis
-
max time kernel
80s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
19-12-2021 01:55
General
-
Target
450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e.exe
-
Size
106KB
-
MD5
3211d985ee354287b4e9d8c65147004d
-
SHA1
c90a48a6f3ef9b46c3678ea5788f3f3fa7169724
-
SHA256
450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e
-
SHA512
81b85364de8e611fc051a5c4cad2a7821b1d0eee11b2e52cfbb9c45f2b8f43191fb2e9b58f9591a8c43e84140255b777ffb3d23a9a0631dc010d4a5663919ce4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e.exepid process 3408 450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e.exedescription pid process Token: SeDebugPrivilege 3408 450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e.exe"C:\Users\Admin\AppData\Local\Temp\450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3408-115-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/3408-117-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/3408-118-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/3408-119-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/3408-120-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/3408-121-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/3408-122-0x0000000005180000-0x0000000005786000-memory.dmpFilesize
6.0MB
-
memory/3408-123-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/3408-124-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/3408-125-0x00000000062A0000-0x00000000062A1000-memory.dmpFilesize
4KB
-
memory/3408-126-0x0000000005EA0000-0x0000000005EA1000-memory.dmpFilesize
4KB
-
memory/3408-127-0x00000000061C0000-0x00000000061C1000-memory.dmpFilesize
4KB
-
memory/3408-128-0x0000000007970000-0x0000000007971000-memory.dmpFilesize
4KB
-
memory/3408-129-0x0000000007B40000-0x0000000007B41000-memory.dmpFilesize
4KB
-
memory/3408-130-0x0000000006C40000-0x0000000006C41000-memory.dmpFilesize
4KB