Analysis
-
max time kernel
176s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 12:56
Static task
static1
Behavioral task
behavioral1
Sample
dde990b668b346c6aa6fc6775c1297f00acefe6118402.exe
Resource
win7-20220414-en
General
-
Target
dde990b668b346c6aa6fc6775c1297f00acefe6118402.exe
-
Size
346KB
-
MD5
450be6421a1e9953154800ff26d70602
-
SHA1
c19697c344e10a3dc788d51238303d564e30447a
-
SHA256
dde990b668b346c6aa6fc6775c1297f00acefe6118402726cc40be11600256f3
-
SHA512
d24e23135cfffd3f043a1edb544a38bab0e117f1961d2139ee7af1b4cdaf612eb3ba04d8e721134c6ef1d9b35468e70c9d817cac08504ee0c215c7b7a6cf6243
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
dde990b668b346c6aa6fc6775c1297f00acefe6118402.exepid process 4884 dde990b668b346c6aa6fc6775c1297f00acefe6118402.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dde990b668b346c6aa6fc6775c1297f00acefe6118402.exedescription pid process Token: SeDebugPrivilege 4884 dde990b668b346c6aa6fc6775c1297f00acefe6118402.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4884-130-0x0000000002C8D000-0x0000000002CB7000-memory.dmpFilesize
168KB
-
memory/4884-131-0x0000000002C30000-0x0000000002C67000-memory.dmpFilesize
220KB
-
memory/4884-132-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/4884-133-0x0000000007300000-0x00000000078A4000-memory.dmpFilesize
5.6MB
-
memory/4884-134-0x00000000078B0000-0x0000000007EC8000-memory.dmpFilesize
6.1MB
-
memory/4884-135-0x0000000007EF0000-0x0000000007F02000-memory.dmpFilesize
72KB
-
memory/4884-136-0x0000000007F10000-0x000000000801A000-memory.dmpFilesize
1.0MB
-
memory/4884-137-0x0000000008020000-0x000000000805C000-memory.dmpFilesize
240KB
-
memory/4884-138-0x0000000008E60000-0x0000000008ED6000-memory.dmpFilesize
472KB
-
memory/4884-139-0x0000000008F00000-0x0000000008F92000-memory.dmpFilesize
584KB
-
memory/4884-140-0x0000000009030000-0x000000000904E000-memory.dmpFilesize
120KB
-
memory/4884-141-0x00000000091D0000-0x0000000009236000-memory.dmpFilesize
408KB
-
memory/4884-142-0x0000000009620000-0x00000000097E2000-memory.dmpFilesize
1.8MB
-
memory/4884-143-0x00000000097F0000-0x0000000009D1C000-memory.dmpFilesize
5.2MB