Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 11:37
Static task
static1
General
-
Target
bfc40f821bc86faf61aa929f3bad576c873bdf751172a4963bce0405ddff55cb.exe
-
Size
474KB
-
MD5
4eabeaec81d686af107f7b1ad4e4573a
-
SHA1
cc05ce25fc12f65b04478d294e52a357f8dde657
-
SHA256
bfc40f821bc86faf61aa929f3bad576c873bdf751172a4963bce0405ddff55cb
-
SHA512
cc6aee82db7ad977b27851776aee894d3594e3610bd22907b9edbaa931289a2372e2da9a0e6b0ce0edbbc9a344e11d356cc02e642f9c8a4b5b1b6c386e098a6a
-
SSDEEP
6144:6LWRewb8LSux1NrTNCclFzJTlp7PJyJ2RVBziCNVNXBSjq7VWRFBMolz90PM:6aR5mdCcl9BlNsAHeIR7VWR5lzqM
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
bfc40f821bc86faf61aa929f3bad576c873bdf751172a4963bce0405ddff55cb.exepid process 3284 bfc40f821bc86faf61aa929f3bad576c873bdf751172a4963bce0405ddff55cb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bfc40f821bc86faf61aa929f3bad576c873bdf751172a4963bce0405ddff55cb.exedescription pid process Token: SeDebugPrivilege 3284 bfc40f821bc86faf61aa929f3bad576c873bdf751172a4963bce0405ddff55cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfc40f821bc86faf61aa929f3bad576c873bdf751172a4963bce0405ddff55cb.exe"C:\Users\Admin\AppData\Local\Temp\bfc40f821bc86faf61aa929f3bad576c873bdf751172a4963bce0405ddff55cb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3284-132-0x0000000004C50000-0x00000000051F4000-memory.dmpFilesize
5.6MB
-
memory/3284-133-0x00000000005BE000-0x00000000005F5000-memory.dmpFilesize
220KB
-
memory/3284-135-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/3284-134-0x0000000002220000-0x0000000002279000-memory.dmpFilesize
356KB
-
memory/3284-136-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/3284-137-0x0000000005860000-0x0000000005872000-memory.dmpFilesize
72KB
-
memory/3284-138-0x0000000005880000-0x000000000598A000-memory.dmpFilesize
1.0MB
-
memory/3284-139-0x0000000005990000-0x00000000059CC000-memory.dmpFilesize
240KB
-
memory/3284-140-0x0000000005CA0000-0x0000000005D06000-memory.dmpFilesize
408KB
-
memory/3284-141-0x0000000006380000-0x0000000006412000-memory.dmpFilesize
584KB
-
memory/3284-142-0x0000000006540000-0x0000000006702000-memory.dmpFilesize
1.8MB
-
memory/3284-143-0x0000000006720000-0x0000000006C4C000-memory.dmpFilesize
5.2MB
-
memory/3284-144-0x0000000006D60000-0x0000000006DD6000-memory.dmpFilesize
472KB
-
memory/3284-145-0x0000000006E20000-0x0000000006E3E000-memory.dmpFilesize
120KB
-
memory/3284-146-0x00000000005BE000-0x00000000005F5000-memory.dmpFilesize
220KB
-
memory/3284-147-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB