Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
08-05-2023 12:25
General
-
Target
f252274a873b52ec33625b8f8ddb77dcdf9dfc8781585d22461f11c9d337b39d.exe
-
Size
12.8MB
-
MD5
41fa51816abea20a91900edaf46d8512
-
SHA1
9e2364263c617c19930a1b374d0c87cf8ab4f6c8
-
SHA256
f252274a873b52ec33625b8f8ddb77dcdf9dfc8781585d22461f11c9d337b39d
-
SHA512
f36c72675bd15a43ed16f6b8e99ff5dd377fe2c7d000470e1ec6eb6500a08ff3956f00f5a9bb9ed2a8b80cc75b3033119eecbfc6a4c898f1c2cf903ea4df391e
-
SSDEEP
98304:6nVtvXa8QN5RRS8hS9/dSIrMyMjhbwg71EZ5wUYL5fi:6nVxxQ7NIdS4MyMjhEuG4Uy5q
Malware Config
Signatures
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
GoLang User-Agent 41 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f252274a873b52ec33625b8f8ddb77dcdf9dfc8781585d22461f11c9d337b39d.exe"C:\Users\Admin\AppData\Local\Temp\f252274a873b52ec33625b8f8ddb77dcdf9dfc8781585d22461f11c9d337b39d.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd ver2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive "$WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"$HOME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyAPP.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\f252274a873b52ec33625b8f8ddb77dcdf9dfc8781585d22461f11c9d337b39d.exe\" $Shortcut.Save()"2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD59f36605efba98dab15728fe8b5538aa0
SHA16a7cff514ae159a59b70f27dde52a3a5dd01b1c8
SHA2569c283f6e81028b9eb0760d918ee4bc0aa256ed3b926393c1734c760c4bd724fd
SHA5121893aa3d1abcf7f9e83911468fa2eeb2ad1d7e23f4586bd6c4d76f9f96a645c15e63e44da55700347165e97b6ac412e6d495b81c3da9faa61d617c7a71a7404c
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
13.2MB
-
Filesize
136KB