Analysis
- max time kernel
117s - max time network
117s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
18/01/2022, 07:52
General
- Target 144e815fb85b76772265ab9a3138ca54.exe
- Size 487KB
- Sample220118-jqfxfaabe6
- SHA256 2fc86c36592b84d4b52a7be23816ad36ca5d8fcf0c9461f700588457a5309c96
Malware Config
Signatures
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\144e815fb85b76772265ab9a3138ca54.exe"C:\Users\Admin\AppData\Local\Temp\144e815fb85b76772265ab9a3138ca54.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/760-55-0x0000000076071000-0x0000000076073000-memory.dmp
memory/760-57-0x0000000000EE0000-0x0000000000F53000-memory.dmp
memory/760-56-0x0000000074C40000-0x0000000074C8A000-memory.dmp
memory/760-58-0x0000000000090000-0x0000000000091000-memory.dmp
memory/760-60-0x0000000074EC0000-0x0000000074F6C000-memory.dmp
memory/760-62-0x0000000000250000-0x0000000000294000-memory.dmp
memory/760-61-0x0000000076020000-0x0000000076067000-memory.dmp
memory/760-63-0x0000000076FE0000-0x0000000077037000-memory.dmp
memory/760-66-0x0000000000EE0000-0x0000000000F53000-memory.dmp
memory/760-65-0x0000000075680000-0x00000000757DC000-memory.dmp
memory/760-67-0x0000000075010000-0x000000007509F000-memory.dmp
memory/760-69-0x0000000076070000-0x0000000076CBA000-memory.dmp
memory/760-70-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/760-71-0x00000000738E0000-0x00000000738F7000-memory.dmp
memory/760-72-0x0000000075D20000-0x0000000075D55000-memory.dmp
memory/760-73-0x0000000073860000-0x000000007387C000-memory.dmp
memory/760-74-0x000000006F620000-0x000000006F635000-memory.dmp
memory/760-75-0x000000006F640000-0x000000006F692000-memory.dmp
memory/760-76-0x000000006F610000-0x000000006F61D000-memory.dmp
memory/760-77-0x0000000075A90000-0x0000000075AA9000-memory.dmp
memory/760-78-0x000000006F560000-0x000000006F5AF000-memory.dmp
memory/760-79-0x000000006F5B0000-0x000000006F608000-memory.dmp
memory/760-80-0x0000000074E50000-0x0000000074E5C000-memory.dmp
memory/760-82-0x0000000075CF0000-0x0000000075D17000-memory.dmp
memory/760-83-0x000000006F730000-0x000000006F774000-memory.dmp
memory/760-84-0x000000006F430000-0x000000006F46D000-memory.dmp
memory/760-85-0x00000000752A0000-0x00000000752AC000-memory.dmp
memory/760-86-0x0000000076E60000-0x0000000076F7D000-memory.dmp
memory/760-87-0x0000000074B00000-0x0000000074B0B000-memory.dmp
memory/760-88-0x000000006F410000-0x000000006F427000-memory.dmp
memory/760-90-0x0000000073B10000-0x0000000073B26000-memory.dmp
memory/760-89-0x000000006F470000-0x000000006F4A8000-memory.dmp
memory/760-91-0x000000006E210000-0x000000006E3A0000-memory.dmp