Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-06-2022 02:13
Static task
static1
Behavioral task
behavioral1
Sample
368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe
Resource
win7-20220414-en
General
-
Target
368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe
-
Size
1.3MB
-
MD5
7f7b8d90e40cf6b2a2d5b13abaed8c0f
-
SHA1
54df19fcd782978d98ceddf0c0ddf9b28dfb2d47
-
SHA256
368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c
-
SHA512
16573f251f4289e298ccd5086d7271f0fb5d5a48f1f26c97904404a58836cbe8043a69eab8e4a41f6b9c7c2c54251658aa2fe5b6342c861d9189339b28277354
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1244-58-0x0000000000400000-0x00000000004FB000-memory.dmp upx behavioral1/memory/1244-60-0x0000000000400000-0x00000000004FB000-memory.dmp upx behavioral1/memory/1244-62-0x0000000000400000-0x00000000004FB000-memory.dmp upx behavioral1/memory/1244-66-0x0000000000400000-0x00000000004FB000-memory.dmp upx behavioral1/memory/1244-67-0x0000000000400000-0x00000000004FB000-memory.dmp upx behavioral1/memory/1244-68-0x0000000000400000-0x00000000004FB000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exedescription pid process target process PID 1968 set thread context of 1244 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exedescription pid process Token: SeDebugPrivilege 1244 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exepid process 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exedescription pid process target process PID 1968 wrote to memory of 1244 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe PID 1968 wrote to memory of 1244 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe PID 1968 wrote to memory of 1244 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe PID 1968 wrote to memory of 1244 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe PID 1968 wrote to memory of 1244 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe PID 1968 wrote to memory of 1244 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe PID 1968 wrote to memory of 1244 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe PID 1968 wrote to memory of 1244 1968 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe 368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe"C:\Users\Admin\AppData\Local\Temp\368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe"C:\Users\Admin\AppData\Local\Temp\368a5feceea5629665f92e86c20ee3349c17fa031c2d262343ee4cd68a9f2c7c.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1244-57-0x0000000000400000-0x00000000004FB000-memory.dmpFilesize
1004KB
-
memory/1244-58-0x0000000000400000-0x00000000004FB000-memory.dmpFilesize
1004KB
-
memory/1244-60-0x0000000000400000-0x00000000004FB000-memory.dmpFilesize
1004KB
-
memory/1244-62-0x0000000000400000-0x00000000004FB000-memory.dmpFilesize
1004KB
-
memory/1244-63-0x00000000004DBBD0-mapping.dmp
-
memory/1244-66-0x0000000000400000-0x00000000004FB000-memory.dmpFilesize
1004KB
-
memory/1244-67-0x0000000000400000-0x00000000004FB000-memory.dmpFilesize
1004KB
-
memory/1244-68-0x0000000000400000-0x00000000004FB000-memory.dmpFilesize
1004KB
-
memory/1968-56-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB