Analysis
- max time kernel
138s - max time network
178s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
02/05/2022, 23:19
General
- Target 3f8689cf9fe4de2059aee85be894a913d56bf60ad2c8fe6f1199e41d291c61c4.exe
- Size 193KB
- Sample220502-3bbtqaeedn
- SHA256 3f8689cf9fe4de2059aee85be894a913d56bf60ad2c8fe6f1199e41d291c61c4
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f8689cf9fe4de2059aee85be894a913d56bf60ad2c8fe6f1199e41d291c61c4.exe"C:\Users\Admin\AppData\Local\Temp\3f8689cf9fe4de2059aee85be894a913d56bf60ad2c8fe6f1199e41d291c61c4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2272-130-0x00000293838D0000-0x0000029383908000-memory.dmp
memory/2272-131-0x00007FF8BEA80000-0x00007FF8BF541000-memory.dmp
memory/2272-132-0x0000029383CC0000-0x0000029383CCA000-memory.dmp
memory/2272-133-0x00000293855C0000-0x00000293855D2000-memory.dmp