Overview

overview

10

Static

static

10

data64_4.exe

windows7_x64

10

data64_4.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    87s
  • max time network
    110s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    26-06-2022 05:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    data64_4.exe

  • Size

    55KB

  • MD5

    b35cde0ed02bf71f1a87721d09746f7b

  • SHA1

    0cf266265f77e387a9d396888651240f2b458e0a

  • SHA256

    47f3c8bf3329c2ef862cf12567849555b17b930c8d7c0d571f4e112dae1453b1

  • SHA512

    59aa3d9c0cbcdbb1d08c563ed322517cd5a52c4dbb039f840a911860c46402304ae889217d1832d5d61af6e080d54d9edfcd3334fc7a8bef2f8f921f232b2344

Score
10/10
recordbreakerdiscoveryspywarestealersuricata

Malware Config

Signatures

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker
  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

    suricata
  • suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    suricata
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\data64_4.exe
    "C:\Users\Admin\AppData\Local\Temp\data64_4.exe"
    1⤵
      PID:888

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/888-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

      Filesize

      8KB

      Download