Analysis
-
max time kernel
49s -
max time network
51s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
04/05/2023, 21:15
General
-
Target
ea0761c14aa2ccd3105bcc35199b49fa0afcf807ed2ba83edf44a02aa0c230ab.exe
-
Size
410KB
-
MD5
2e6b57a118783655eff25f88575b4401
-
SHA1
24534c3fb395e61a605e87425c265e55d80bfc91
-
SHA256
ea0761c14aa2ccd3105bcc35199b49fa0afcf807ed2ba83edf44a02aa0c230ab
-
SHA512
cfa3c9cdb51558b84ec0b07b3a4346b5951985886c8f93337fbf472dd820e0feb956c79f3df66828c716ab802113f00908d89769f7246f478ca6980f6fa5275f
-
SSDEEP
6144:zkHyCZeR6P60HVTW6nEgYBgmByiSXCGsJ6E0Ht9r/:YHvZeR6S2VzegmBACGS0NZ/
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea0761c14aa2ccd3105bcc35199b49fa0afcf807ed2ba83edf44a02aa0c230ab.exe"C:\Users\Admin\AppData\Local\Temp\ea0761c14aa2ccd3105bcc35199b49fa0afcf807ed2ba83edf44a02aa0c230ab.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
-
Filesize
184KB
-
Filesize
5.0MB
-
Filesize
176KB
-
Filesize
6.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
3.0MB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
248KB
-
Filesize
3.0MB