Analysis
- max time kernel
165s - max time network
171s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
09/11/2022, 16:02
General
- Target 1a.scr
- Size 1.9MB
- Sample221109-tg31qaabd6
- SHA256 464640bb9eaea6dd08a6ccc40be701f172f9d7785cf1e16f8e4dffcda413cb79
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a.scr"C:\Users\Admin\AppData\Local\Temp\1a.scr" /S1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4920-132-0x00000000023B0000-0x00000000023EB000-memory.dmp
memory/4920-133-0x0000000011B00000-0x0000000012118000-memory.dmp
memory/4920-134-0x0000000011AA0000-0x0000000011AB2000-memory.dmp
memory/4920-135-0x0000000012120000-0x000000001222A000-memory.dmp
memory/4920-136-0x0000000012230000-0x000000001226C000-memory.dmp
memory/4920-137-0x00000000127A0000-0x0000000012806000-memory.dmp
memory/4920-138-0x0000000012BB0000-0x0000000012C42000-memory.dmp
memory/4920-139-0x0000000012C50000-0x00000000131F4000-memory.dmp
memory/4920-140-0x0000000013310000-0x0000000013386000-memory.dmp
memory/4920-141-0x00000000132F0000-0x000000001330E000-memory.dmp
memory/4920-142-0x0000000013580000-0x0000000013742000-memory.dmp
memory/4920-143-0x0000000013750000-0x0000000013C7C000-memory.dmp