Analysis
- max time kernel
175s - max time network
214s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 06:56
General
- Target 7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe
- Size 1.2MB
- Sample220520-hqcdkshgcj
- SHA256 7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc
Malware Config
Signatures
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe"C:\Users\Admin\AppData\Local\Temp\7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2620-130-0x0000000002D21000-0x0000000002E6A000-memory.dmp
memory/2620-131-0x000000000E0D0000-0x000000000E217000-memory.dmp
memory/2620-132-0x000000000E0D0000-0x000000000E217000-memory.dmp
memory/3316-134-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3316-136-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3316-137-0x0000000007C60000-0x0000000008278000-memory.dmp
memory/3316-138-0x00000000076D0000-0x00000000076E2000-memory.dmp
memory/3316-139-0x0000000007800000-0x000000000790A000-memory.dmp
memory/3316-140-0x0000000007730000-0x000000000776C000-memory.dmp
memory/3316-141-0x0000000007A70000-0x0000000007AE6000-memory.dmp
memory/3316-142-0x0000000007B90000-0x0000000007C22000-memory.dmp
memory/3316-143-0x0000000008830000-0x0000000008DD4000-memory.dmp
memory/3316-144-0x0000000007B50000-0x0000000007B6E000-memory.dmp
memory/3316-145-0x00000000085C0000-0x0000000008626000-memory.dmp
memory/3316-146-0x0000000004AE0000-0x0000000004B30000-memory.dmp
memory/3316-147-0x0000000006480000-0x0000000006642000-memory.dmp
memory/3316-148-0x0000000006B80000-0x00000000070AC000-memory.dmp