Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-12-2021 05:07
Static task
static1
Behavioral task
behavioral1
Sample
5367ca900ff1988ce2ee1c93b241c764.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
5367ca900ff1988ce2ee1c93b241c764.exe
-
Size
104KB
-
MD5
5367ca900ff1988ce2ee1c93b241c764
-
SHA1
9b5ef337871490ed36f31bb18b0b4d318039e23c
-
SHA256
07bb36227d8121f29c43baae188b43f3d5c4885ef4b20410fca8985235168c68
-
SHA512
5eea26bb98893617a4fbdaad8cba09d09985170936f340773fab38b656a0ac19ca296a3d6cce2114399affdbd7d1cd4f08a6bc4aedebe4d6c55a5ff4ce841a41
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5367ca900ff1988ce2ee1c93b241c764.exepid process 2672 5367ca900ff1988ce2ee1c93b241c764.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5367ca900ff1988ce2ee1c93b241c764.exedescription pid process Token: SeDebugPrivilege 2672 5367ca900ff1988ce2ee1c93b241c764.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2672-115-0x0000000000100000-0x0000000000120000-memory.dmpFilesize
128KB
-
memory/2672-116-0x0000000000100000-0x0000000000120000-memory.dmpFilesize
128KB
-
memory/2672-117-0x0000000004E90000-0x0000000005496000-memory.dmpFilesize
6.0MB
-
memory/2672-118-0x0000000004900000-0x0000000004912000-memory.dmpFilesize
72KB
-
memory/2672-119-0x0000000004A30000-0x0000000004B3A000-memory.dmpFilesize
1.0MB
-
memory/2672-120-0x0000000004960000-0x000000000499E000-memory.dmpFilesize
248KB
-
memory/2672-121-0x0000000004880000-0x0000000004E86000-memory.dmpFilesize
6.0MB
-
memory/2672-122-0x00000000049A0000-0x00000000049EB000-memory.dmpFilesize
300KB
-
memory/2672-123-0x00000000059A0000-0x0000000005E9E000-memory.dmpFilesize
5.0MB
-
memory/2672-124-0x0000000004CF0000-0x0000000004D66000-memory.dmpFilesize
472KB
-
memory/2672-125-0x00000000054A0000-0x0000000005532000-memory.dmpFilesize
584KB
-
memory/2672-126-0x0000000004DF0000-0x0000000004E0E000-memory.dmpFilesize
120KB
-
memory/2672-127-0x00000000058B0000-0x0000000005916000-memory.dmpFilesize
408KB
-
memory/2672-128-0x0000000006370000-0x0000000006532000-memory.dmpFilesize
1.8MB
-
memory/2672-129-0x0000000006A70000-0x0000000006F9C000-memory.dmpFilesize
5.2MB
-
memory/2672-130-0x00000000023D0000-0x0000000002420000-memory.dmpFilesize
320KB