Analysis
- max time kernel
87s - max time network
89s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
17/05/2023, 05:44
General
- Target file.exe
- Size 321KB
- Sample230517-ge513sch3z
- SHA256 9e168c82de9d5a9cfaca738e8a210dc756a6286264b73ef4c5d1ae32f6c25d67
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3888-134-0x00000000022D0000-0x000000000230F000-memory.dmp
memory/3888-136-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/3888-135-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/3888-137-0x0000000004DF0000-0x0000000005394000-memory.dmp
memory/3888-138-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/3888-139-0x000000000A920000-0x000000000AF38000-memory.dmp
memory/3888-140-0x000000000AF90000-0x000000000B09A000-memory.dmp
memory/3888-141-0x000000000B0D0000-0x000000000B0E2000-memory.dmp
memory/3888-142-0x000000000B0F0000-0x000000000B12C000-memory.dmp
memory/3888-143-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/3888-144-0x000000000B3D0000-0x000000000B446000-memory.dmp
memory/3888-145-0x000000000B450000-0x000000000B4E2000-memory.dmp
memory/3888-146-0x000000000B4F0000-0x000000000B556000-memory.dmp
memory/3888-147-0x0000000000400000-0x00000000006CE000-memory.dmp
memory/3888-148-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/3888-149-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/3888-150-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/3888-151-0x000000000BE80000-0x000000000BED0000-memory.dmp
memory/3888-152-0x000000000BF10000-0x000000000C0D2000-memory.dmp
memory/3888-153-0x000000000C0E0000-0x000000000C60C000-memory.dmp
memory/3888-154-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/3888-156-0x0000000000400000-0x00000000006CE000-memory.dmp