Analysis
- max time kernel
121s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 23:14
General
- Target 21a14dc71295897a68767fa5c1b20a2e.exe
- Size 943KB
- Sample220107-27z1radbbk
- SHA256 c08e045c647f80c57f8e6a5fee965b01d8420f775a3f5d9c2b67ef23e3638e06
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\21a14dc71295897a68767fa5c1b20a2e.exe"C:\Users\Admin\AppData\Local\Temp\21a14dc71295897a68767fa5c1b20a2e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/684-115-0x0000000000B20000-0x0000000000C10000-memory.dmp
memory/684-116-0x0000000000B20000-0x0000000000C10000-memory.dmp
memory/684-117-0x0000000005960000-0x0000000005E5E000-memory.dmp
memory/684-118-0x0000000005500000-0x0000000005592000-memory.dmp
memory/684-119-0x00000000058A0000-0x0000000005916000-memory.dmp
memory/684-120-0x0000000005490000-0x00000000054AE000-memory.dmp
memory/684-121-0x0000000006030000-0x0000000006031000-memory.dmp
memory/684-122-0x0000000005E80000-0x0000000005E8A000-memory.dmp
memory/1152-123-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1152-125-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1152-126-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1152-127-0x00000000054F0000-0x0000000005AF6000-memory.dmp
memory/1152-128-0x0000000004F80000-0x0000000004F92000-memory.dmp
memory/1152-129-0x00000000050B0000-0x00000000051BA000-memory.dmp
memory/1152-130-0x0000000005010000-0x0000000005076000-memory.dmp
memory/1152-131-0x0000000005480000-0x00000000054BE000-memory.dmp
memory/1152-132-0x0000000005B00000-0x0000000005B4B000-memory.dmp
memory/1152-133-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
memory/1152-134-0x0000000006AA0000-0x0000000006F9E000-memory.dmp
memory/1152-135-0x0000000006620000-0x0000000006696000-memory.dmp
memory/1152-136-0x0000000006740000-0x00000000067D2000-memory.dmp
memory/1152-137-0x0000000006400000-0x000000000641E000-memory.dmp
memory/1152-138-0x0000000007E20000-0x0000000007FE2000-memory.dmp
memory/1152-139-0x0000000008520000-0x0000000008A4C000-memory.dmp
memory/1152-140-0x00000000070A0000-0x00000000070F0000-memory.dmp