Analysis
- max time kernel
152s - max time network
190s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
20/01/2023, 01:28
General
- Target 8361eb12c5601bdc3cc6446f7c9799bd.exe
- Size 668KB
- Sample230120-bvntvaac36
- SHA256 372e830ca920a5f2b66e8980e5b9ddedd9343a5c23c6fb48adfc762568eacb51
Score
7/10
Malware Config
Signatures
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8361eb12c5601bdc3cc6446f7c9799bd.exe"C:\Users\Admin\AppData\Local\Temp\8361eb12c5601bdc3cc6446f7c9799bd.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4896-132-0x00000000003A0000-0x000000000044E000-memory.dmp
memory/4896-133-0x0000000005290000-0x0000000005834000-memory.dmp
memory/4896-134-0x0000000004DE0000-0x0000000004E72000-memory.dmp
memory/4896-135-0x0000000004F80000-0x0000000004F8A000-memory.dmp
memory/4896-136-0x00000000050C0000-0x000000000515C000-memory.dmp
memory/4896-137-0x0000000005C80000-0x0000000005CE6000-memory.dmp
memory/4896-138-0x0000000006770000-0x00000000067C0000-memory.dmp