Analysis
- max time kernel
110s - max time network
129s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
08/01/2022, 15:59
General
- Target 2d3e4a0d5db026c1778ed5d261846c1f.exe
- Size 665KB
- Sample220108-te3beadeem
- SHA256 e5fa3a5fc4f1e1c8286a6bd37ea4b40f6879e629f27e64e7dd491fb42dc6fe36
Malware Config
Signatures
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d3e4a0d5db026c1778ed5d261846c1f.exe"C:\Users\Admin\AppData\Local\Temp\2d3e4a0d5db026c1778ed5d261846c1f.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Green\neofit.exeneofit.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2600-118-0x0000000004970000-0x00000000049DB000-memory.dmp
memory/2600-120-0x0000000000400000-0x0000000002BDC000-memory.dmp
memory/2600-119-0x0000000004A50000-0x0000000004B1E000-memory.dmp
memory/3568-131-0x0000000005760000-0x000000000579E000-memory.dmp
memory/3568-135-0x0000000004B32000-0x0000000004B33000-memory.dmp
memory/3568-126-0x0000000004B40000-0x000000000503E000-memory.dmp
memory/3568-127-0x00000000024D0000-0x0000000002502000-memory.dmp
memory/3568-129-0x0000000004AB0000-0x0000000004AC2000-memory.dmp
memory/3568-128-0x0000000005040000-0x0000000005646000-memory.dmp
memory/3568-130-0x0000000005650000-0x000000000575A000-memory.dmp
memory/3568-132-0x00000000001C0000-0x00000000001F9000-memory.dmp
memory/3568-133-0x0000000000400000-0x000000000047A000-memory.dmp
memory/3568-134-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/3568-125-0x0000000002220000-0x0000000002254000-memory.dmp
memory/3568-136-0x0000000004B33000-0x0000000004B34000-memory.dmp
memory/3568-137-0x0000000004B34000-0x0000000004B36000-memory.dmp
memory/3568-138-0x00000000057A0000-0x00000000057EB000-memory.dmp
memory/3568-139-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/3568-140-0x00000000060E0000-0x0000000006156000-memory.dmp
memory/3568-141-0x00000000061A0000-0x0000000006232000-memory.dmp
memory/3568-142-0x0000000006390000-0x00000000063AE000-memory.dmp
memory/3568-143-0x00000000065C0000-0x0000000006782000-memory.dmp
memory/3568-144-0x0000000006790000-0x0000000006CBC000-memory.dmp