Analysis
- max time kernel
55s - max time network
44s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
20/01/2023, 01:28
General
- Target 8361eb12c5601bdc3cc6446f7c9799bd.exe
- Size 668KB
- Sample230120-bvntvaac36
- SHA256 372e830ca920a5f2b66e8980e5b9ddedd9343a5c23c6fb48adfc762568eacb51
Score
7/10
Malware Config
Signatures
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8361eb12c5601bdc3cc6446f7c9799bd.exe"C:\Users\Admin\AppData\Local\Temp\8361eb12c5601bdc3cc6446f7c9799bd.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1404-54-0x0000000000F50000-0x0000000000FFE000-memory.dmp
memory/1404-55-0x0000000075451000-0x0000000075453000-memory.dmp
memory/1404-56-0x00000000002D0000-0x00000000002E6000-memory.dmp
memory/1404-57-0x00000000005D0000-0x00000000005DA000-memory.dmp
memory/1404-58-0x0000000005370000-0x00000000053DA000-memory.dmp
memory/1404-59-0x0000000000B80000-0x0000000000BB0000-memory.dmp
memory/1404-60-0x0000000000BB0000-0x0000000000BE0000-memory.dmp