Analysis
-
max time kernel
73s -
max time network
94s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
-
submitted
10-08-2022 11:00
General
-
Target
pack/AeSRJ.exe
-
Size
5.3MB
-
MD5
95c9c83e4d5f20a4bd8a5354cec20d27
-
SHA1
4f75dc7c374a15026bc3e557d5849d8f27414971
-
SHA256
ae8b777d1cb934b3f9badd12d3599c739aa7b8972f99b48a5ba668866e34fff4
-
SHA512
72c65d5a5162355d251c4452b050355c686b751719ee9ccbd6e19f3e414dbf1aea598e1704aad7183f2c1654622927fd84badd36b42e845ffc5496cf0eb808fd
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pack\AeSRJ.exe"C:\Users\Admin\AppData\Local\Temp\pack\AeSRJ.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken