47b0ac227a39cee9aa33607231ce88237ea4b9b2a1841382bba9d0a3ba7f1120

Analysis

max time kernel
379s
max time network
431s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47b0ac227a39cee9aa33607231ce88237ea4b9b2a1841382bba9d0a3ba7f1120.exe
Size

920KB
MD5

fc24d4ff2defdedd65ec9a1f7ec5a9e6
SHA1

b1c523ef2df8df0db0afa255857c8dd4b47fbf97
SHA256

47b0ac227a39cee9aa33607231ce88237ea4b9b2a1841382bba9d0a3ba7f1120
SHA512

8a0e273020aa61afa6964aeb40f649c34e1b6ae1b2c7eca82a7776dc8bd45e75e10152cddfdef23627f0077c8b0e81c27bede4c955ff895d176b953765911584
SSDEEP

24576:h1OYdaOIMtdHAqcdDVhYwiei7+EpFAh/kK9:h1OsxPHVmVhYwiLtKkK9

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Prl8LNdGbmxZjk4.exe

pid process

2116 Prl8LNdGbmxZjk4.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

Prl8LNdGbmxZjk4.exe

pid	process
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe
2116	Prl8LNdGbmxZjk4.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Prl8LNdGbmxZjk4.exe

description	pid	process
Token: SeDebugPrivilege	2116	Prl8LNdGbmxZjk4.exe
Token: SeDebugPrivilege	2116	Prl8LNdGbmxZjk4.exe
Token: SeDebugPrivilege	2116	Prl8LNdGbmxZjk4.exe
Token: SeDebugPrivilege	2116	Prl8LNdGbmxZjk4.exe
Token: SeDebugPrivilege	2116	Prl8LNdGbmxZjk4.exe
Token: SeDebugPrivilege	2116	Prl8LNdGbmxZjk4.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

47b0ac227a39cee9aa33607231ce88237ea4b9b2a1841382bba9d0a3ba7f1120.exe

description	pid	process	target process
PID 4116 wrote to memory of 2116	4116	47b0ac227a39cee9aa33607231ce88237ea4b9b2a1841382bba9d0a3ba7f1120.exe	Prl8LNdGbmxZjk4.exe
PID 4116 wrote to memory of 2116	4116	47b0ac227a39cee9aa33607231ce88237ea4b9b2a1841382bba9d0a3ba7f1120.exe	Prl8LNdGbmxZjk4.exe
PID 4116 wrote to memory of 2116	4116	47b0ac227a39cee9aa33607231ce88237ea4b9b2a1841382bba9d0a3ba7f1120.exe	Prl8LNdGbmxZjk4.exe

C:\Users\Admin\AppData\Local\Temp\47b0ac227a39cee9aa33607231ce88237ea4b9b2a1841382bba9d0a3ba7f1120.exe
"C:\Users\Admin\AppData\Local\Temp\47b0ac227a39cee9aa33607231ce88237ea4b9b2a1841382bba9d0a3ba7f1120.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4116

C:\Users\Admin\AppData\Local\Temp\7zSD293.tmp\Prl8LNdGbmxZjk4.exe
.\Prl8LNdGbmxZjk4.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSD293.tmp\Prl8LNdGbmxZjk4.dat
Filesize
1KB

MD5
180b2d0b2b19070e4078b2ac44df2008

SHA1
5b7488dd94d236ba39e3f1c0ca39f6aabbbe1080

SHA256
5cec248625cd768138295c93efc004847de99332ad183eff49586054501e4bd5

SHA512
683e27125c0fa7e728fd673e91f8bd260856a3a24ea4c62007294ecd879ce2855ea289323ab9cd069cc5995042a387b8d8408254982e10d70cb51486fb65cfde

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD293.tmp\Prl8LNdGbmxZjk4.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD293.tmp\Prl8LNdGbmxZjk4.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD293.tmp\hmniblmcjpppfojhflnjlmjehenpgpof\background.html
Filesize
141B

MD5
cc1c35a29149b85d8fa5892ed9112ee8

SHA1
356ec7d088e67b10154fb636f3d5093787ac016b

SHA256
57ee6e4c0f8e387747c54b30385cf79c0f8ab3cfb0cc52fe593f3ccc99012618

SHA512
0af27ee3e4931ce1699d37f376ffe7861d8bf4ae81cdeeb35d269e9963fd1d4fef8a5c0af3e9fe2772fce0fc642eeb372348b5d881f535a1911b4595fcb11337

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD293.tmp\hmniblmcjpppfojhflnjlmjehenpgpof\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
memory/2116-132-0x0000000000000000-mapping.dmp

Download