Analysis
-
max time kernel
91s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
16-09-2022 12:08
General
-
Target
trimmed_1663329827_dbeaver-install.exe
-
Size
209KB
-
MD5
40d322d24c17aac5a6c3c10d20acedf3
-
SHA1
be6ca8d13ef8f597c1f5c859fa2e304061699d30
-
SHA256
11f8a26affde505645a82fa141de07a622b9adc0285789596d4c077327028f14
-
SHA512
58fef212a5c23a78ea386b0b588b50ff3d64aa885ade43b2c7ca958c52de711578d1ab65fd31945dd5d9ed2cc6ad0975cb13785ce555f80beb6ace5bbe0b2b86
-
SSDEEP
3072:K4a5qEIlqf/NgnYi3xAWNvjeg0xOHjxrrVj5dptJU3bKSQFbz0swH4sEf3dV1qcV:KJeo/N0YO3NExQ7jLF5bZwH4Jz1qcZm
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\trimmed_1663329827_dbeaver-install.exe"C:\Users\Admin\AppData\Local\Temp\trimmed_1663329827_dbeaver-install.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
-
Filesize
320KB
-
Filesize
10.8MB
-
Filesize
10.8MB