Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09-06-2022 14:12
General
-
Target
7zS8A52FD1B/62a1ea23342ae_c77562.exe
-
Size
242KB
-
MD5
2db62b3e5088b61ead161e0482b2f6f2
-
SHA1
a13b707e24ae6269631ce1099263cbc793f4b2a1
-
SHA256
c277eac5a2f147b839219c2327a2d7e6c85be9dabe91c8a92b553e2cadc9e3c3
-
SHA512
9c287e38c61c28ee0fce45b8734a979d6c74dbdd8648327ac7f7d24e9a2c07736eff70f2f8ca33ddd6196d4b629865ae35abd0de8e784e989179618aa1d72774
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea23342ae_c77562.exe"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea23342ae_c77562.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1540-54-0x0000000000900000-0x0000000000942000-memory.dmpFilesize
264KB
-
memory/1540-55-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB