Analysis
-
max time kernel
142s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 14:00
Behavioral task
behavioral1
Sample
Akt sverki nachalo iyulya.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
Akt sverki nachalo iyulya.exe
-
Size
998KB
-
MD5
e35bc27eaa316431da022774ad0b9ab7
-
SHA1
9e937f904319dbc8d7d8cdef81119ded0db96093
-
SHA256
65163c2a5608d66d615a284943d5ebf811a78e6ecebec47835b4680a19d07518
-
SHA512
9167f11c31cfead7e1b199ce754461ad28563175bba0756e24256992dfaa10c6b136139ac0261551c623e9b23255bd2bde91646d54a928704b8a711cfbb6d21b
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 15 WinHttp.WinHttpRequest.5.1 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Akt sverki nachalo iyulya.exedescription pid process target process PID 1140 wrote to memory of 1928 1140 Akt sverki nachalo iyulya.exe Akt sverki nachalo iyulya.exe PID 1140 wrote to memory of 1928 1140 Akt sverki nachalo iyulya.exe Akt sverki nachalo iyulya.exe PID 1140 wrote to memory of 1928 1140 Akt sverki nachalo iyulya.exe Akt sverki nachalo iyulya.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Akt sverki nachalo iyulya.exe"C:\Users\Admin\AppData\Local\Temp\Akt sverki nachalo iyulya.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Akt sverki nachalo iyulya.exe"C:\Users\Admin\AppData\Local\Temp\Akt sverki nachalo iyulya.exe" dfsr2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1140-130-0x0000000002240000-0x000000000224E000-memory.dmpFilesize
56KB
-
memory/1140-132-0x0000000000400000-0x00000000004FE000-memory.dmpFilesize
1016KB
-
memory/1928-131-0x0000000000000000-mapping.dmp
-
memory/1928-133-0x0000000000400000-0x00000000004FE000-memory.dmpFilesize
1016KB