Analysis
- max time kernel
142s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
10/08/2023, 13:02
General
- Target 24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe
- Size 419KB
- Sample230810-p92wxach32
- SHA256 24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161
Malware Config
Signatures
- Downloads MZ/PE file
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe"C:\Users\Admin\AppData\Local\Temp\24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
System.Data.SQLite.dll
System.Data.SQLite.dll
SQLite.Interop.dll
memory/3032-137-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/3032-135-0x0000000004CB0000-0x0000000004CCA000-memory.dmp
memory/3032-138-0x0000000005F60000-0x0000000005FC6000-memory.dmp
memory/3032-147-0x0000000006290000-0x0000000006322000-memory.dmp
memory/3032-148-0x0000000006210000-0x0000000006222000-memory.dmp
memory/3032-149-0x0000000006600000-0x00000000067C2000-memory.dmp
memory/3032-136-0x0000000005280000-0x0000000005824000-memory.dmp
memory/3032-133-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/3032-153-0x0000000006980000-0x00000000069E2000-memory.dmp
memory/3032-134-0x0000000000330000-0x00000000003A0000-memory.dmp
memory/3032-159-0x0000000006E80000-0x0000000006EBC000-memory.dmp
memory/3032-170-0x0000000007CB0000-0x0000000007D26000-memory.dmp
memory/3032-171-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/3032-176-0x0000000074530000-0x0000000074CE0000-memory.dmp