Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/01/2023, 21:18

General

  • Target

    Sеtup.exe

  • Size

    4.3MB

  • MD5

    93475c7eb2830b66c3df41323b5d56ae

  • SHA1

    000a633c84615bb4e04605d7716a7fa41e0169f2

  • SHA256

    12c0844de2f1ce6a7e0b9ca8f0ff569a3fb817d93e60c719ef8edf3dba363c23

  • SHA512

    cb07e4642043b14ae1f9c6825e884412fcd5ef8fc3bd358d5451394af3870007ad8ac6ad314e081a7d209775a29082d2cd369e116456c65d6fa6621aad54ec18

  • SSDEEP

    49152:vTgIheW24XJSastfj5NTpGktKDJ3MgmxeKhIAP8ZpGjaAtoJUTbd02F14Nte:vLhe/4XJIFjyhAPIJUiNo

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sеtup.exe
    "C:\Users\Admin\AppData\Local\Temp\Sеtup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:32
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic path win32_VideoController get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic path win32_VideoController get name
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2616
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic cpu get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic cpu get name
        3⤵
          PID:4920

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads