Analysis
- max time kernel
80s - max time network
139s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 11:19
General
- Target a99f5c3c299b6e42370d19a8d84269cd.exe
- Size 863KB
- Sample220107-nevzfacbe6
- SHA256 11f148e988012cd40eefde0e603fc34263eba3a85d080723b7997e081418ab2f
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a99f5c3c299b6e42370d19a8d84269cd.exe"C:\Users\Admin\AppData\Local\Temp\a99f5c3c299b6e42370d19a8d84269cd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2712-114-0x0000000000400000-0x00000000005F7000-memory.dmp
memory/2712-115-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/2712-117-0x0000000000980000-0x0000000000981000-memory.dmp
memory/2712-116-0x0000000000800000-0x000000000094A000-memory.dmp
memory/2712-118-0x00000000008C0000-0x00000000008EF000-memory.dmp
memory/2712-124-0x0000000000AC0000-0x0000000000AE0000-memory.dmp
memory/2712-125-0x0000000000AC0000-0x0000000000AE0000-memory.dmp
memory/2712-126-0x0000000005870000-0x0000000005E76000-memory.dmp
memory/2712-127-0x0000000002B00000-0x0000000002B12000-memory.dmp
memory/2712-128-0x0000000005860000-0x0000000005861000-memory.dmp
memory/2712-129-0x0000000005862000-0x0000000005863000-memory.dmp
memory/2712-130-0x0000000005863000-0x0000000005864000-memory.dmp
memory/2712-131-0x0000000002E80000-0x0000000002F8A000-memory.dmp
memory/2712-132-0x0000000002F90000-0x0000000002FCE000-memory.dmp
memory/2712-133-0x0000000003000000-0x000000000304B000-memory.dmp
memory/2712-134-0x0000000005864000-0x0000000005865000-memory.dmp
memory/2712-135-0x00000000057A0000-0x0000000005816000-memory.dmp
memory/2712-136-0x0000000005E80000-0x0000000005F12000-memory.dmp
memory/2712-137-0x0000000005F20000-0x000000000641E000-memory.dmp
memory/2712-138-0x00000000064D0000-0x00000000064EE000-memory.dmp
memory/2712-139-0x0000000006AC0000-0x0000000006B26000-memory.dmp
memory/2712-140-0x0000000007220000-0x00000000073E2000-memory.dmp
memory/2712-141-0x0000000007400000-0x000000000792C000-memory.dmp