Analysis
- max time kernel
119s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
26/12/2021, 12:56
General
- Target 380cd876dd3a7dbe477ea7ceaa47e6c72e53a762f0e5e.exe
- Size 437KB
- Sample211226-p6cslsaahq
- SHA256 380cd876dd3a7dbe477ea7ceaa47e6c72e53a762f0e5e14aabf8c71702325fdd
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\380cd876dd3a7dbe477ea7ceaa47e6c72e53a762f0e5e.exe"C:\Users\Admin\AppData\Local\Temp\380cd876dd3a7dbe477ea7ceaa47e6c72e53a762f0e5e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3720-115-0x00000000007C1000-0x00000000007ED000-memory.dmp
memory/3720-116-0x0000000004B10000-0x0000000004B44000-memory.dmp
memory/3720-118-0x0000000000400000-0x00000000004EE000-memory.dmp
memory/3720-117-0x00000000001C0000-0x00000000001F9000-memory.dmp
memory/3720-119-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/3720-121-0x0000000004BD2000-0x0000000004BD3000-memory.dmp
memory/3720-120-0x0000000004BE0000-0x00000000050DE000-memory.dmp
memory/3720-122-0x0000000004BD3000-0x0000000004BD4000-memory.dmp
memory/3720-123-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3720-124-0x00000000050F0000-0x00000000056F6000-memory.dmp
memory/3720-125-0x0000000005780000-0x0000000005792000-memory.dmp
memory/3720-126-0x00000000057B0000-0x00000000058BA000-memory.dmp
memory/3720-127-0x0000000005900000-0x000000000593E000-memory.dmp
memory/3720-128-0x0000000004BD4000-0x0000000004BD6000-memory.dmp
memory/3720-129-0x0000000005950000-0x000000000599B000-memory.dmp
memory/3720-130-0x0000000005AF0000-0x0000000005B56000-memory.dmp
memory/3720-131-0x00000000062B0000-0x0000000006326000-memory.dmp
memory/3720-132-0x0000000006350000-0x00000000063E2000-memory.dmp
memory/3720-133-0x0000000006440000-0x000000000645E000-memory.dmp
memory/3720-134-0x0000000006670000-0x0000000006832000-memory.dmp
memory/3720-135-0x0000000006840000-0x0000000006D6C000-memory.dmp