Analysis
- max time kernel
117s - max time network
117s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
08/01/2022, 15:59
General
- Target 2d3e4a0d5db026c1778ed5d261846c1f.exe
- Size 665KB
- Sample220108-te3beadeem
- SHA256 e5fa3a5fc4f1e1c8286a6bd37ea4b40f6879e629f27e64e7dd491fb42dc6fe36
Malware Config
Signatures
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d3e4a0d5db026c1778ed5d261846c1f.exe"C:\Users\Admin\AppData\Local\Temp\2d3e4a0d5db026c1778ed5d261846c1f.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Green\neofit.exeneofit.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1688-54-0x0000000076071000-0x0000000076073000-memory.dmp
memory/1688-56-0x00000000044A0000-0x000000000456E000-memory.dmp
memory/1688-55-0x00000000002E0000-0x000000000034B000-memory.dmp
memory/1688-57-0x0000000000400000-0x0000000002BDC000-memory.dmp
memory/2012-62-0x0000000000568000-0x0000000000594000-memory.dmp
memory/2012-63-0x0000000000300000-0x0000000000339000-memory.dmp
memory/2012-64-0x00000000004E0000-0x0000000000514000-memory.dmp
memory/2012-66-0x0000000004931000-0x0000000004932000-memory.dmp
memory/2012-67-0x0000000004932000-0x0000000004933000-memory.dmp
memory/2012-65-0x0000000000400000-0x000000000047A000-memory.dmp
memory/2012-68-0x0000000004933000-0x0000000004934000-memory.dmp
memory/2012-69-0x0000000000520000-0x0000000000552000-memory.dmp
memory/2012-70-0x0000000004934000-0x0000000004936000-memory.dmp