Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-08-2022 06:32
General
-
Target
BjWXPytPSJRdiLA.exe
-
Size
215KB
-
MD5
306d61b898d8ca0ac21e0cea238dc164
-
SHA1
bb293cdaf8da2ae4d9bdb18a52626ca78cb0cb28
-
SHA256
963e8cf8e1df3604fd6e6c163b9be24125dfb764196eb71e936dd01deae08004
-
SHA512
b4cf5db97e8617cf41f3732d841341b17b79ed3939ad2a53fba8845606831782c8149efaefb637ca11788d15ea5dbb9366274bf182144d0917c21ab4178615ce
-
SSDEEP
3072:omQa+GAEz+ip3BJqTeUvrTGnXR/XRlf/ryiusenhgFUaoGu5D0I2OSoYUHIL:oWp31U2XR/DGiuPhgFUxGud0IktUH
Score
7/10
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BjWXPytPSJRdiLA.exe"C:\Users\Admin\AppData\Local\Temp\BjWXPytPSJRdiLA.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB