Analysis
- max time kernel
82s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
30/01/2023, 15:53
General
- Target 8e8ddaedf0f03a1c4caff563dc4aa73de9c52d5b7e0fbe650038e9279d08b2e9.exe
- Size 146KB
- Sample230130-tb5blacf4v
- SHA256 8e8ddaedf0f03a1c4caff563dc4aa73de9c52d5b7e0fbe650038e9279d08b2e9
Malware Config
Signatures
- Downloads MZ/PE file
- Loads dropped DLL 5 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e8ddaedf0f03a1c4caff563dc4aa73de9c52d5b7e0fbe650038e9279d08b2e9.exe"C:\Users\Admin\AppData\Local\Temp\8e8ddaedf0f03a1c4caff563dc4aa73de9c52d5b7e0fbe650038e9279d08b2e9.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Ionic.Zip.dll
Ionic.Zip.dll
System.Data.SQLite.dll
System.Data.SQLite.dll
SQLite.Interop.dll
memory/2280-138-0x0000000005B60000-0x0000000005BC2000-memory.dmp
memory/2280-132-0x0000000000120000-0x000000000014A000-memory.dmp
memory/2280-135-0x0000000006D30000-0x0000000006EF2000-memory.dmp
memory/2280-140-0x0000000007570000-0x00000000075AC000-memory.dmp
memory/2280-141-0x0000000008380000-0x00000000083F6000-memory.dmp
memory/2280-142-0x0000000008400000-0x0000000008466000-memory.dmp
memory/2280-134-0x0000000005CD0000-0x0000000006274000-memory.dmp
memory/2280-133-0x0000000005680000-0x0000000005712000-memory.dmp
memory/2280-145-0x0000000008470000-0x00000000084E8000-memory.dmp