Analysis
- max time kernel
148s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/03/2022, 15:48
General
- Target 2153e47a0dc1bb8431f3a5ba0cf4d8d6.exe
- Size 361KB
- Sample220321-s8vyradgdj
- SHA256 4f6070fe259cd83ed1947c7e56fac48d29869bdf8fb4ef4d853acdc4dc64760b
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2153e47a0dc1bb8431f3a5ba0cf4d8d6.exe"C:\Users\Admin\AppData\Local\Temp\2153e47a0dc1bb8431f3a5ba0cf4d8d6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1392-130-0x00000000005EE000-0x000000000061A000-memory.dmp
memory/1392-131-0x0000000004BF0000-0x0000000005194000-memory.dmp
memory/1392-132-0x00000000005EE000-0x000000000061A000-memory.dmp
memory/1392-133-0x00000000021C0000-0x00000000021F9000-memory.dmp
memory/1392-134-0x0000000000400000-0x0000000000485000-memory.dmp
memory/1392-135-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/1392-136-0x0000000005250000-0x0000000005868000-memory.dmp
memory/1392-138-0x00000000058A0000-0x00000000058B2000-memory.dmp
memory/1392-137-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/1392-139-0x0000000004BE2000-0x0000000004BE3000-memory.dmp
memory/1392-141-0x00000000058C0000-0x00000000059CA000-memory.dmp
memory/1392-140-0x0000000004BE3000-0x0000000004BE4000-memory.dmp
memory/1392-142-0x00000000059F0000-0x0000000005A2C000-memory.dmp
memory/1392-143-0x0000000004BE4000-0x0000000004BE6000-memory.dmp
memory/1392-144-0x0000000005D00000-0x0000000005D76000-memory.dmp
memory/1392-145-0x0000000005DF0000-0x0000000005E82000-memory.dmp
memory/1392-146-0x0000000005FB0000-0x0000000005FCE000-memory.dmp
memory/1392-147-0x0000000006020000-0x0000000006086000-memory.dmp
memory/1392-148-0x0000000006750000-0x0000000006912000-memory.dmp
memory/1392-149-0x0000000006920000-0x0000000006E4C000-memory.dmp
memory/1392-150-0x00000000070A0000-0x00000000070F0000-memory.dmp