Analysis
-
max time kernel
27s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
13/02/2023, 07:15
General
-
Target
7c1dba5124792af1b2e652a240e5f4fc.exe
-
Size
361KB
-
MD5
7c1dba5124792af1b2e652a240e5f4fc
-
SHA1
d493c6f0ad4608c0740f2d467e4eb99bba18523a
-
SHA256
f1f5dcfc3ffd836a34d8c61bee9b797ab75e992f21842f3f75273604253b2a75
-
SHA512
6e709fc64ed3683278ee0f0603dbda3d6ebb9523e056f7094d97c89cfddc6c60e4437bae2bbe221f214679ca313eec2157e1ef32b0c9b1d3157f43550cfedb9a
-
SSDEEP
6144:S8pfI9WK+yGvgzY1d6qGvGq3dwBEKuwlGl/9Cp2F9dEnn8ZF6ERa:SQvgseqNq3deEDJl/c2Fy
Score
6/10
Malware Config
Signatures
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c1dba5124792af1b2e652a240e5f4fc.exe"C:\Users\Admin\AppData\Local\Temp\7c1dba5124792af1b2e652a240e5f4fc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
8KB