Analysis
-
max time kernel
143s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2023 14:37
Static task
static1
General
-
Target
EXPENSIVE LOADER.exe
-
Size
1.3MB
-
MD5
bfb9334833749790c0df81ab1489c5a9
-
SHA1
b38e3080dfb1d35ae303b9f0c14a7cf12621de7c
-
SHA256
cc16768fe66b11c07282c6d5d543701b85b283a44de51fdd4a9bd2a014f37b68
-
SHA512
e41a66d9932f7853c9015ef0361cfbf4702a31d356e97dae1fb9ece085b808cac0e9a5d6d70a2763d08b3f940aacc074181bae6755077933d97f9a92b93c65d1
-
SSDEEP
24576:bw3SBs2Mhfs2OcpIi5aO9z1dn7Az8Zk61NlPXYpky7vKCB/nO:E3P2MhkPTaz1tswiKPXYpkyjKCB/O
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
EXPENSIVE LOADER.exepid process 5040 EXPENSIVE LOADER.exe 5040 EXPENSIVE LOADER.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
EXPENSIVE LOADER.exepid process 5040 EXPENSIVE LOADER.exe 5040 EXPENSIVE LOADER.exe 5040 EXPENSIVE LOADER.exe 5040 EXPENSIVE LOADER.exe 5040 EXPENSIVE LOADER.exe 5040 EXPENSIVE LOADER.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EXPENSIVE LOADER.exedescription pid process Token: SeDebugPrivilege 5040 EXPENSIVE LOADER.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
EXPENSIVE LOADER.exepid process 5040 EXPENSIVE LOADER.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXPENSIVE LOADER.exe"C:\Users\Admin\AppData\Local\Temp\EXPENSIVE LOADER.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\44\Browsers\Firefox\Bookmarks.txtFilesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\ProgramData\44\Process.txtFilesize
1KB
MD588761398cff8c3d886ce409564bda0ec
SHA1e6710bef7e03cf4597ce3dc78404a9bebc18a852
SHA256245e1a7fec5536307c0941338bb0f50a29c599b2b1903688198d87ec639b89d1
SHA5124b92003fca9d13b74c76b6e34ac0134bf94f8f0693f00f96ef9c106ac72a50e199612d954c44385575616a39e283fd82e47f3deffa599fe884349a2467bc4d29
-
C:\ProgramData\44\Process.txtFilesize
1KB
MD588761398cff8c3d886ce409564bda0ec
SHA1e6710bef7e03cf4597ce3dc78404a9bebc18a852
SHA256245e1a7fec5536307c0941338bb0f50a29c599b2b1903688198d87ec639b89d1
SHA5124b92003fca9d13b74c76b6e34ac0134bf94f8f0693f00f96ef9c106ac72a50e199612d954c44385575616a39e283fd82e47f3deffa599fe884349a2467bc4d29
-
C:\ProgramData\44\Process.txtFilesize
1KB
MD588761398cff8c3d886ce409564bda0ec
SHA1e6710bef7e03cf4597ce3dc78404a9bebc18a852
SHA256245e1a7fec5536307c0941338bb0f50a29c599b2b1903688198d87ec639b89d1
SHA5124b92003fca9d13b74c76b6e34ac0134bf94f8f0693f00f96ef9c106ac72a50e199612d954c44385575616a39e283fd82e47f3deffa599fe884349a2467bc4d29
-
memory/5040-138-0x0000000074100000-0x00000000748B0000-memory.dmpFilesize
7.7MB
-
memory/5040-139-0x0000000000410000-0x000000000081A000-memory.dmpFilesize
4.0MB
-
memory/5040-140-0x0000000000410000-0x000000000081A000-memory.dmpFilesize
4.0MB
-
memory/5040-141-0x0000000009090000-0x00000000090A0000-memory.dmpFilesize
64KB
-
memory/5040-142-0x000000000A3A0000-0x000000000A432000-memory.dmpFilesize
584KB
-
memory/5040-133-0x0000000000410000-0x000000000081A000-memory.dmpFilesize
4.0MB
-
memory/5040-175-0x000000000A9F0000-0x000000000AF94000-memory.dmpFilesize
5.6MB
-
memory/5040-137-0x0000000077B42000-0x0000000077B43000-memory.dmpFilesize
4KB
-
memory/5040-135-0x0000000000410000-0x000000000081A000-memory.dmpFilesize
4.0MB
-
memory/5040-134-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/5040-265-0x00000000099E0000-0x0000000009A46000-memory.dmpFilesize
408KB
-
memory/5040-268-0x0000000000410000-0x000000000081A000-memory.dmpFilesize
4.0MB
-
memory/5040-269-0x0000000074100000-0x00000000748B0000-memory.dmpFilesize
7.7MB