Analysis
- max time kernel
119s - max time network
119s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
20/01/2022, 09:01
General
- Target 7deaf50454d78538183484487fd64c45.exe
- Size 395KB
- Sample220120-kywtashca8
- SHA256 8e93854353199edccef78bae97288dbf5876c2e14afa36e1d33b1ec3fda434f1
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7deaf50454d78538183484487fd64c45.exe"C:\Users\Admin\AppData\Local\Temp\7deaf50454d78538183484487fd64c45.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svc32.exe"C:\Users\Admin\AppData\Local\Temp\svc32.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1184-70-0x0000000000400000-0x000000000049E000-memory.dmp
memory/1184-69-0x0000000000570000-0x0000000000605000-memory.dmp
memory/1184-68-0x0000000000510000-0x000000000056F000-memory.dmp
memory/1668-60-0x00000000047A2000-0x00000000047A3000-memory.dmp
memory/1668-62-0x0000000004710000-0x0000000004742000-memory.dmp
memory/1668-63-0x0000000075F81000-0x0000000075F83000-memory.dmp
memory/1668-64-0x00000000047A4000-0x00000000047A6000-memory.dmp
memory/1668-61-0x00000000047A3000-0x00000000047A4000-memory.dmp
memory/1668-59-0x00000000047A1000-0x00000000047A2000-memory.dmp
memory/1668-55-0x00000000003A0000-0x00000000003CB000-memory.dmp
memory/1668-58-0x0000000001DB0000-0x0000000001DE4000-memory.dmp
memory/1668-57-0x0000000000400000-0x000000000046A000-memory.dmp
memory/1668-56-0x0000000000470000-0x00000000004A9000-memory.dmp