87b13727cc7881a5af744b338a166a5d31d17c063d25aecc57991f11cb317f16

Resubmissions

11/05/2023, 16:01

11/05/2023, 15:51

max time kernel
209s
max time network
238s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2023, 16:01

Target

032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d.exe
Size

134KB
MD5

ad6a2cddcf2d8955ecec900cb2432aff
SHA1

5e85fe7bddfd0dc0da4f11162b911a0c86765455
SHA256

032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d
SHA512

d79956cbfcf5ccc5f590f2a13bbc0ac4fa557e9c3f0781395398c318ed117718aa8955656223523a876c7020e9ff144b9be075b642b835cf7fac359b53f16c52
SSDEEP

1536:93KuYpOqh2zQhwJUYxogXnJkaryJN2xK50ZysRBqT3WrBvJyXg+wr02xvw9XJ5y2:93KrOr0C5M2xK2ZyiB23qJogbxvwg2

Score

10^/10

stealer titan

matching unpacked titan stealer sample 1 IoCs

Titan Stealer.

resource	yara_rule
behavioral1/memory/3316-134-0x0000000000430000-0x0000000000444000-memory.dmp	titanStealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 3316	3920	032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d.exe	84

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3316	3920	032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d.exe	84
PID 3920 wrote to memory of 3316	3920	032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d.exe	84
PID 3920 wrote to memory of 3316	3920	032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d.exe	84
PID 3920 wrote to memory of 3316	3920	032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d.exe	84
PID 3920 wrote to memory of 3316	3920	032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d.exe	84

C:\Users\Admin\AppData\Local\Temp\032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d.exe
"C:\Users\Admin\AppData\Local\Temp\032c59d8a9364ce30ded3ef4aa5cd6b6d632d1fcd994c03de02088db247e7d2d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:3316

memory/3316-134-0x0000000000430000-0x0000000000444000-memory.dmp

Filesize
80KB

Download