3a989ec907525ae8cb488002641bd24876c524141035430cb75562d08691f5c7

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/04/2023, 18:54

Target

file.exe
Size

305KB
MD5

cbae5ce2d5c73d03569811c99b7e60d4
SHA1

465651b979221d10253bd6c648ba2448aded1340
SHA256

3a989ec907525ae8cb488002641bd24876c524141035430cb75562d08691f5c7
SHA512

711bef6fc5cb81205618535c727500b4fc6cd475c49005ffa15533fcc6624f0d5dc79d1d1e6f1d1bd2c641e5fe9d271dcd427d6ea7a6c3ce55bff90e9885d543
SSDEEP

3072:oGZ9Ri9WNrWCGjnKT0yOYAMUyXu58lAaUiKUzsg8fBy+hxB+qT3E6H4kV5aupHoV:oGRi9WLJT0yO6y0KUYfp3x/DH5l9Nd

Score

6^/10

spyware

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 1968	1368	file.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
580	1368	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	AppLaunch.exe
1968	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1968	1368	file.exe	28
PID 1368 wrote to memory of 1968	1368	file.exe	28
PID 1368 wrote to memory of 1968	1368	file.exe	28
PID 1368 wrote to memory of 1968	1368	file.exe	28
PID 1368 wrote to memory of 1968	1368	file.exe	28
PID 1368 wrote to memory of 1968	1368	file.exe	28
PID 1368 wrote to memory of 1968	1368	file.exe	28
PID 1368 wrote to memory of 1968	1368	file.exe	28
PID 1368 wrote to memory of 1968	1368	file.exe	28
PID 1368 wrote to memory of 580	1368	file.exe	29
PID 1368 wrote to memory of 580	1368	file.exe	29
PID 1368 wrote to memory of 580	1368	file.exe	29
PID 1368 wrote to memory of 580	1368	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 36
  2⤵
  - Program crash
  PID:580

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1968-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1968-55-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1968-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1968-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1968-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1968-63-0x00000000008C0000-0x0000000000900000-memory.dmp

Filesize
256KB

Download