Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2022 10:26
Behavioral task
behavioral1
Sample
D4E46DED5BCA4A7086100E2296E9F434D357AF08CC515.exe
Resource
win7-20220718-en
windows7-x64
6 signatures
150 seconds
General
-
Target
D4E46DED5BCA4A7086100E2296E9F434D357AF08CC515.exe
-
Size
3.5MB
-
MD5
9ce5f14b8594d39723d696d393ed5cd5
-
SHA1
920a12bb0dce60d81d9b149a5d8fb8e7893ffd56
-
SHA256
d4e46ded5bca4a7086100e2296e9f434d357af08cc5153091834f0b6969133f6
-
SHA512
b0652648aa7b94764be0f27a4941680c6a7ba12b367713e2aac149be1ccd572ecaf1deca6d637e23f4995c04b636d240445f849bbc7bae7ffd6b3b441e7b1be6
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1960-130-0x0000000000400000-0x0000000000970000-memory.dmp vmprotect -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
D4E46DED5BCA4A7086100E2296E9F434D357AF08CC515.exepid process 1960 D4E46DED5BCA4A7086100E2296E9F434D357AF08CC515.exe 1960 D4E46DED5BCA4A7086100E2296E9F434D357AF08CC515.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
D4E46DED5BCA4A7086100E2296E9F434D357AF08CC515.exedescription pid process Token: SeDebugPrivilege 1960 D4E46DED5BCA4A7086100E2296E9F434D357AF08CC515.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1960-130-0x0000000000400000-0x0000000000970000-memory.dmpFilesize
5.4MB
-
memory/1960-133-0x0000000004FB0000-0x0000000005554000-memory.dmpFilesize
5.6MB
-
memory/1960-134-0x0000000005560000-0x0000000005B78000-memory.dmpFilesize
6.1MB
-
memory/1960-135-0x0000000004F40000-0x0000000004F52000-memory.dmpFilesize
72KB
-
memory/1960-136-0x0000000005B80000-0x0000000005C8A000-memory.dmpFilesize
1.0MB
-
memory/1960-137-0x0000000005C90000-0x0000000005CCC000-memory.dmpFilesize
240KB
-
memory/1960-138-0x0000000005E60000-0x0000000005ED6000-memory.dmpFilesize
472KB
-
memory/1960-139-0x0000000005EE0000-0x0000000005F72000-memory.dmpFilesize
584KB
-
memory/1960-140-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/1960-141-0x0000000006280000-0x00000000062E6000-memory.dmpFilesize
408KB
-
memory/1960-142-0x0000000006AB0000-0x0000000006B00000-memory.dmpFilesize
320KB
-
memory/1960-143-0x0000000000B90000-0x0000000000D52000-memory.dmpFilesize
1.8MB
-
memory/1960-144-0x0000000006B00000-0x000000000702C000-memory.dmpFilesize
5.2MB