3d55fc3ed1c8b736d494b9478c73391e3e051a673f19631033dd67b6203ef22f

Analysis

max time kernel
30s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2023, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

build_230301_103133.exe
Size

1.3MB
MD5

380e55fad355c66b6cdfe0c3be796e7d
SHA1

e0dd90b8eb68c81176e93f15fd1fd5dbea3267a4
SHA256

3d55fc3ed1c8b736d494b9478c73391e3e051a673f19631033dd67b6203ef22f
SHA512

d07ed346a48909fcb2ceb782bd7d52b5e990a8ddc1ca0cf29e1cf738fd615062239a2e4753d6491b64a8d7a0e60327d8043f932b70a62bf25f1530ca580681d2
SSDEEP

12288:xmN1bLIYBeEfgWJDPNczOnWNTbn/ysbJRdPwQoXkI7e0MT5NOZoQyxaIEuaOuRBg:xmQ/EYuDw

Score

6^/10

spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5100 set thread context of 3820	5100	build_230301_103133.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3820	AppLaunch.exe
3820	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	build_230301_103133.exe
Token: SeDebugPrivilege	3820	AppLaunch.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3820	5100	build_230301_103133.exe	93
PID 5100 wrote to memory of 3820	5100	build_230301_103133.exe	93
PID 5100 wrote to memory of 3820	5100	build_230301_103133.exe	93
PID 5100 wrote to memory of 3820	5100	build_230301_103133.exe	93
PID 5100 wrote to memory of 3820	5100	build_230301_103133.exe	93
PID 5100 wrote to memory of 3820	5100	build_230301_103133.exe	93
PID 5100 wrote to memory of 3820	5100	build_230301_103133.exe	93
PID 5100 wrote to memory of 3820	5100	build_230301_103133.exe	93

C:\Users\Admin\AppData\Local\Temp\build_230301_103133.exe
"C:\Users\Admin\AppData\Local\Temp\build_230301_103133.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3820-142-0x0000000005250000-0x00000000052B6000-memory.dmp

Filesize
408KB

Download
memory/3820-143-0x0000000005E30000-0x0000000005EC2000-memory.dmp

Filesize
584KB

Download
memory/3820-135-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3820-137-0x0000000005470000-0x0000000005A88000-memory.dmp

Filesize
6.1MB

Download
memory/3820-138-0x0000000004E80000-0x0000000004E92000-memory.dmp

Filesize
72KB

Download
memory/3820-139-0x0000000004FB0000-0x00000000050BA000-memory.dmp

Filesize
1.0MB

Download
memory/3820-149-0x0000000007DB0000-0x00000000082DC000-memory.dmp

Filesize
5.2MB

Download
memory/3820-140-0x0000000004EE0000-0x0000000004F1C000-memory.dmp

Filesize
240KB

Download
memory/3820-148-0x00000000076B0000-0x0000000007872000-memory.dmp

Filesize
1.8MB

Download
memory/3820-141-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/3820-144-0x0000000006480000-0x0000000006A24000-memory.dmp

Filesize
5.6MB

Download
memory/3820-145-0x0000000005ED0000-0x0000000005F20000-memory.dmp

Filesize
320KB

Download
memory/3820-146-0x0000000005FA0000-0x0000000006016000-memory.dmp

Filesize
472KB

Download
memory/3820-147-0x0000000005F20000-0x0000000005F3E000-memory.dmp

Filesize
120KB

Download
memory/5100-133-0x00000000003C0000-0x0000000000510000-memory.dmp

Filesize
1.3MB

Download
memory/5100-134-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Filesize
64KB

Download