Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2023, 07:26

General

  • Target

    2023080181301512300.exe

  • Size

    654KB

  • MD5

    211cc9065649db3cd6d2b27b60904f62

  • SHA1

    6c724039b6995607dee6d5d6a48b06c806eb355c

  • SHA256

    fe8fe2d1a57f344afaebc018a90acfd787b897b2a5baffd045980ff7a5c00bc3

  • SHA512

    e9b318ebaaf9b7f69e94521a3554732eade544b6d80c11a3164eca1f14efea35c57aa402081e1db02e01aed9cb8c5528a03623d7418bcb517ac19bf571f6b67d

  • SSDEEP

    12288:3W23/gPrk6AQRxwZlOK1q3hfwqrSg/b596cBs2yov2QdOBu5p/I:dwrk6VqOK1q3hfzSg/j6cjyC/dOBu5pQ

Score
7/10

Malware Config

Signatures

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023080181301512300.exe
    "C:\Users\Admin\AppData\Local\Temp\2023080181301512300.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4004-133-0x0000000075290000-0x0000000075A40000-memory.dmp

    Filesize

    7.7MB

  • memory/4004-134-0x00000000008B0000-0x000000000095A000-memory.dmp

    Filesize

    680KB

  • memory/4004-135-0x00000000058A0000-0x0000000005E44000-memory.dmp

    Filesize

    5.6MB

  • memory/4004-136-0x0000000005390000-0x0000000005422000-memory.dmp

    Filesize

    584KB

  • memory/4004-137-0x00000000055F0000-0x0000000005600000-memory.dmp

    Filesize

    64KB

  • memory/4004-138-0x0000000005320000-0x000000000532A000-memory.dmp

    Filesize

    40KB

  • memory/4004-139-0x0000000075290000-0x0000000075A40000-memory.dmp

    Filesize

    7.7MB

  • memory/4004-140-0x00000000055F0000-0x0000000005600000-memory.dmp

    Filesize

    64KB

  • memory/4004-141-0x000000000A850000-0x000000000A8EC000-memory.dmp

    Filesize

    624KB

  • memory/4004-142-0x000000000AAF0000-0x000000000AB56000-memory.dmp

    Filesize

    408KB

  • memory/4004-143-0x00000000081B0000-0x0000000008200000-memory.dmp

    Filesize

    320KB

  • memory/4004-144-0x00000000083D0000-0x0000000008592000-memory.dmp

    Filesize

    1.8MB