Analysis
-
max time kernel
298s -
max time network
319s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
27/08/2023, 20:10
General
-
Target
Soft.exe
-
Size
855.2MB
-
MD5
fb61cbd8e373a64a5b5c5224248f28c9
-
SHA1
3feaa5e93191412bf21eac0aeb88715c5b02690a
-
SHA256
b5fb87f26faf6bfd0bc49d818f67b8ddc06a481cf42d3e61dcc57aba9a6befd4
-
SHA512
abd7f27b2024cc94d0f0791eb9c5e3fd17ab1f01a87db8b8c17c8c0ebfd30c206517d1e8889952eb93ae1ca49dc22dcf6405ce54158fb573c0d633cd9e2f561f
-
SSDEEP
3072:jJdxYVsvlrk2ycpm1fC/zFJrkWilZ2fkWc6/T+jfOWe2brfnRRQfEfxX6deP:ssvlrxqkpMZwkWc7jf33uEfxqeP
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Soft.exe"C:\Users\Admin\AppData\Local\Temp\Soft.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD50deddb3cd02f97a1b29228e249b3b365
SHA1fecda2c925798a04ad17871124a441dd96ae1730
SHA256f347f9e4d3dd0ce266a5d225c0471e33386c659c6c2425a1b2e625864e538b9b
SHA51223d186926572a79bd7cec17ddfc8dc49e97097636cf34cdbc4a8b3d6b590362635cb41200da96385cbc9da4d255cef65bf5bf2cd964c37c331ef9d1dec50eeb0
-
Filesize
13B
MD552e2479d75e086f9c280ec6ab5ae4fe6
SHA12750d987041c869ebc4be655f31b5803a677fb8b
SHA2567f4007c917578896645f1844af5459e9218c709da14c5465e687ca61604a3de6
SHA512d74deb991dcc9c83c86989040405752caefc9313e5f20ca64fcf1c96a278bfd381ebf58e7ac9fc67aea0e699bdaa915319945ab7a1a0daab3ba4279f9774d1ff
-
Filesize
176KB
-
Filesize
120KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
176KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
6.9MB