Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
30-03-2023 14:59
General
-
Target
5a1a37fb68eeb445df8c647dab8af952.exe
-
Size
48KB
-
MD5
5a1a37fb68eeb445df8c647dab8af952
-
SHA1
95f2c1a9ae32d39ed616d2007bbcf6f74feba18f
-
SHA256
631d7e6e0d9b03928ea24c0f846e3aad741bd675b8837035e8bdc028dc25fc98
-
SHA512
349c588d9fc96ecf4db16004afec719e00e6ec887a4d89319a150b9ef75b1836fb8dfbff1a1fc0953a0dccf6a27ae117a00cd94c0991ecc70931fd1349cd8d05
-
SSDEEP
768:4g/hgfJYO9KqosayemfSbvZ5l9GCAPk2/PWC/cEnUSBQtP9:R/hgGO9KrHmKbvtelRJnUSBiP9
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a1a37fb68eeb445df8c647dab8af952.exe"C:\Users\Admin\AppData\Local\Temp\5a1a37fb68eeb445df8c647dab8af952.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
512KB
-
Filesize
512KB