Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 13:42
General
-
Target
8d949b3a294fe15396308f27f1ad287c6e845d45a9180bccfec4f8bc4d569c71.exe
-
Size
459KB
-
MD5
afdb9995f0e5db969d77c4808f540f13
-
SHA1
74e9a123098ff4fc344fb27b5e1a9103c1cebc3e
-
SHA256
8d949b3a294fe15396308f27f1ad287c6e845d45a9180bccfec4f8bc4d569c71
-
SHA512
135c668ed0e899874b32f1c253e00ad1f6a8811d65eff5547f1221cdff9b8071e249a9197b7107c6d4b4691e0366d80e03209fe0813c61909bb4b8b78f7bceb1
-
SSDEEP
12288:a3aOZZnaNk09pBKhWSzJmNoVqsd5yAi8YWe2dVY:a3aMZnSk09pCWSzvf4Ai8v3dVY
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Drops file in Drivers directory 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d949b3a294fe15396308f27f1ad287c6e845d45a9180bccfec4f8bc4d569c71.exe"C:\Users\Admin\AppData\Local\Temp\8d949b3a294fe15396308f27f1ad287c6e845d45a9180bccfec4f8bc4d569c71.exe"1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
-
Filesize
656KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
20KB