Analysis

  • max time kernel
    50s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06-05-2023 14:04

General

  • Target

    file.exe

  • Size

    1.8MB

  • MD5

    13adf671ae056aa0e01e696c05736758

  • SHA1

    151edf47d4cf1f8bebe095502b4f4e8ed06dc59b

  • SHA256

    68837e50b37413708ed70f69651613342706345d14d3c2c21ed8ca3e298e5115

  • SHA512

    ae8b633b4234bb470b4acc16c267086a69c12ee6b5bc292b44d1b5536ee47c9517a7201c5f424224938ea5e9875a9ed7f0bef1e9ddd62876cfc12287870e67bf

  • SSDEEP

    12288:3y7uix2TBXVnBGw4I/6QTdp7lRpIlfMer5iiTvdyyF55bI8NMXzpuwFKzCctAtdX:SFzMXzAwPZ

Score
6/10

Malware Config

Signatures

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:924

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/924-63-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/924-73-0x0000000000450000-0x0000000000490000-memory.dmp

    Filesize

    256KB

  • memory/924-72-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/924-71-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/924-70-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/924-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/924-65-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/924-64-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/924-62-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1056-59-0x0000000005600000-0x0000000005640000-memory.dmp

    Filesize

    256KB

  • memory/1056-61-0x0000000000340000-0x0000000000346000-memory.dmp

    Filesize

    24KB

  • memory/1056-60-0x0000000000320000-0x000000000033A000-memory.dmp

    Filesize

    104KB

  • memory/1056-54-0x0000000000E10000-0x0000000000FEC000-memory.dmp

    Filesize

    1.9MB

  • memory/1056-67-0x0000000005600000-0x0000000005640000-memory.dmp

    Filesize

    256KB

  • memory/1056-68-0x0000000005600000-0x0000000005640000-memory.dmp

    Filesize

    256KB

  • memory/1056-69-0x0000000005600000-0x0000000005640000-memory.dmp

    Filesize

    256KB

  • memory/1056-58-0x0000000005600000-0x0000000005640000-memory.dmp

    Filesize

    256KB

  • memory/1056-57-0x00000000002D0000-0x00000000002E8000-memory.dmp

    Filesize

    96KB

  • memory/1056-56-0x00000000004A0000-0x00000000004EA000-memory.dmp

    Filesize

    296KB

  • memory/1056-55-0x0000000005600000-0x0000000005640000-memory.dmp

    Filesize

    256KB