Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2022 02:06
Static task
static1
Behavioral task
behavioral1
Sample
dbf20dc429b1ae7162eae6fe859333e380c57f1681dac.exe
Resource
win7-20220718-en
General
-
Target
dbf20dc429b1ae7162eae6fe859333e380c57f1681dac.exe
-
Size
443KB
-
MD5
99342a4b5ce806ef4ab2a6d89ba8e99e
-
SHA1
99ae91c56960c1149ecdc56b92f0c236c369c1f7
-
SHA256
dbf20dc429b1ae7162eae6fe859333e380c57f1681dac1b31f401b209e0e93fd
-
SHA512
d84cadb85d8deb204fcadb8dde53b68c255c0926f5d979792b8a9335874848c2ca25148f53d0b7a7ce5fcfca5fea8e118ad0090a76884112dc448b55532517f8
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dbf20dc429b1ae7162eae6fe859333e380c57f1681dac.exepid process 4244 dbf20dc429b1ae7162eae6fe859333e380c57f1681dac.exe 4244 dbf20dc429b1ae7162eae6fe859333e380c57f1681dac.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dbf20dc429b1ae7162eae6fe859333e380c57f1681dac.exedescription pid process Token: SeDebugPrivilege 4244 dbf20dc429b1ae7162eae6fe859333e380c57f1681dac.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4244-130-0x0000000004C20000-0x00000000051C4000-memory.dmpFilesize
5.6MB
-
memory/4244-131-0x00000000004A9000-0x00000000004D4000-memory.dmpFilesize
172KB
-
memory/4244-132-0x0000000002080000-0x00000000020B8000-memory.dmpFilesize
224KB
-
memory/4244-133-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/4244-134-0x00000000051D0000-0x00000000057E8000-memory.dmpFilesize
6.1MB
-
memory/4244-135-0x0000000005800000-0x0000000005812000-memory.dmpFilesize
72KB
-
memory/4244-136-0x0000000005820000-0x000000000592A000-memory.dmpFilesize
1.0MB
-
memory/4244-137-0x0000000005950000-0x000000000598C000-memory.dmpFilesize
240KB
-
memory/4244-138-0x00000000068C0000-0x0000000006952000-memory.dmpFilesize
584KB
-
memory/4244-139-0x0000000006970000-0x00000000069D6000-memory.dmpFilesize
408KB
-
memory/4244-140-0x0000000006CD0000-0x0000000006D46000-memory.dmpFilesize
472KB
-
memory/4244-141-0x0000000006DE0000-0x0000000006DFE000-memory.dmpFilesize
120KB
-
memory/4244-142-0x00000000073E0000-0x0000000007430000-memory.dmpFilesize
320KB
-
memory/4244-143-0x00000000075C0000-0x0000000007782000-memory.dmpFilesize
1.8MB
-
memory/4244-144-0x0000000007790000-0x0000000007CBC000-memory.dmpFilesize
5.2MB
-
memory/4244-145-0x00000000004A9000-0x00000000004D4000-memory.dmpFilesize
172KB
-
memory/4244-146-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/4244-147-0x00000000004A9000-0x00000000004D4000-memory.dmpFilesize
172KB