Analysis
- max time kernel
144s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
24/07/2023, 15:56
General
- Target 0633f12fe0e7ba0eda6b612ac9e08e1f.exe
- Size 460KB
- Sample230724-tdcpcsfc23
- SHA256 600eb91c53c6fd01ef5881045d8fe7b4fb7f96978ca05fdcab15e1edabff8236
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0633f12fe0e7ba0eda6b612ac9e08e1f.exe"C:\Users\Admin\AppData\Local\Temp\0633f12fe0e7ba0eda6b612ac9e08e1f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/988-134-0x00000000025C0000-0x00000000026C0000-memory.dmp
memory/988-135-0x0000000004190000-0x00000000041DF000-memory.dmp
memory/988-136-0x0000000000400000-0x0000000002444000-memory.dmp
memory/988-137-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/988-138-0x0000000006AC0000-0x0000000006AD0000-memory.dmp
memory/988-139-0x0000000006C30000-0x00000000071D4000-memory.dmp
memory/988-140-0x0000000009770000-0x0000000009802000-memory.dmp
memory/988-141-0x0000000000400000-0x0000000002444000-memory.dmp
memory/988-142-0x0000000006AC0000-0x0000000006AD0000-memory.dmp
memory/988-143-0x0000000009990000-0x000000000999A000-memory.dmp
memory/988-144-0x00000000025C0000-0x00000000026C0000-memory.dmp
memory/988-145-0x0000000009DE0000-0x000000000A3F8000-memory.dmp
memory/988-146-0x0000000009A50000-0x0000000009A62000-memory.dmp
memory/988-147-0x0000000004190000-0x00000000041DF000-memory.dmp
memory/988-148-0x0000000009A70000-0x0000000009B7A000-memory.dmp
memory/988-149-0x0000000009B80000-0x0000000009BBC000-memory.dmp
memory/988-150-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/988-151-0x000000000A400000-0x000000000A466000-memory.dmp
memory/988-152-0x000000000AA70000-0x000000000AAE6000-memory.dmp
memory/988-153-0x000000000AB50000-0x000000000AD12000-memory.dmp
memory/988-154-0x000000000AD30000-0x000000000B25C000-memory.dmp
memory/988-155-0x000000000B360000-0x000000000B37E000-memory.dmp
memory/988-157-0x00000000044B0000-0x0000000004500000-memory.dmp
memory/988-158-0x0000000006AC0000-0x0000000006AD0000-memory.dmp