Analysis
-
max time kernel
110s -
max time network
113s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 03:43
General
-
Target
cddc1e15fcfcb29cfcb3631f1d478640d228fd9ea38c01d347833567970d04e3.exe
-
Size
6.6MB
-
MD5
ae2ba63a82ebe6a75f17a5c7a6bc9b96
-
SHA1
8339a1113066fd69f0d4642808579817979e8ba2
-
SHA256
cddc1e15fcfcb29cfcb3631f1d478640d228fd9ea38c01d347833567970d04e3
-
SHA512
8181d3b03ee149cc3fb1208903b12ab6f96437ecaeddc647c15dca8e8feff0c7f55c98035cd5149792b56b893a6313115a65cef8c8b285bf84c34ebff77cbfb8
Malware Config
Signatures
-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cddc1e15fcfcb29cfcb3631f1d478640d228fd9ea38c01d347833567970d04e3.exe"C:\Users\Admin\AppData\Local\Temp\cddc1e15fcfcb29cfcb3631f1d478640d228fd9ea38c01d347833567970d04e3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.3MB
-
Filesize
8KB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB