Analysis
-
max time kernel
77s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04-03-2023 00:02
Behavioral task
behavioral1
Sample
51b10c2bc0b214ecdd7511918ce615d9.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
General
-
Target
51b10c2bc0b214ecdd7511918ce615d9.exe
-
Size
97KB
-
MD5
51b10c2bc0b214ecdd7511918ce615d9
-
SHA1
5099c0a9a8f6aada2845ecc9350d282235e154e1
-
SHA256
2088c6ea8ac26f01d0fb39667f4772674eb8c6e627f5f61399b1e3d1f21d99ca
-
SHA512
71e70ec5f93141694326ab00723c92271d354a1fea3ed44d39deb3e54b4948bf293222deed7899a5e502fc9a9cca88d272f5671e074afd784551cd603d7ee5fb
-
SSDEEP
1536:jIJEmHg1ZqTrbRgkfmgYqT4hd1+F53T8DSyvOQdlkTvXkzbkUql/d8uqh9:uLA1YgkV1EaqOQdlLFql/d8uqh
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 51b10c2bc0b214ecdd7511918ce615d9.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 51b10c2bc0b214ecdd7511918ce615d9.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeTcbPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeChangeNotifyPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeCreateTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeBackupPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeRestorePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeIncreaseQuotaPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeAssignPrimaryTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeImpersonatePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeTcbPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeChangeNotifyPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeCreateTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeBackupPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeRestorePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeIncreaseQuotaPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeAssignPrimaryTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeImpersonatePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeTcbPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeChangeNotifyPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeCreateTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeBackupPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeRestorePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeIncreaseQuotaPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeAssignPrimaryTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeImpersonatePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeTcbPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeChangeNotifyPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeCreateTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeBackupPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeRestorePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeIncreaseQuotaPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeAssignPrimaryTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeImpersonatePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeTcbPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeChangeNotifyPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeCreateTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeBackupPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeRestorePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeIncreaseQuotaPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeAssignPrimaryTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeImpersonatePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeTcbPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeChangeNotifyPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeCreateTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeBackupPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeRestorePrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeIncreaseQuotaPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe Token: SeAssignPrimaryTokenPrivilege 1428 51b10c2bc0b214ecdd7511918ce615d9.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 51b10c2bc0b214ecdd7511918ce615d9.exe