Analysis
-
max time kernel
112s -
max time network
310s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
27/08/2023, 20:10
General
-
Target
Soft.exe
-
Size
855.2MB
-
MD5
fb61cbd8e373a64a5b5c5224248f28c9
-
SHA1
3feaa5e93191412bf21eac0aeb88715c5b02690a
-
SHA256
b5fb87f26faf6bfd0bc49d818f67b8ddc06a481cf42d3e61dcc57aba9a6befd4
-
SHA512
abd7f27b2024cc94d0f0791eb9c5e3fd17ab1f01a87db8b8c17c8c0ebfd30c206517d1e8889952eb93ae1ca49dc22dcf6405ce54158fb573c0d633cd9e2f561f
-
SSDEEP
3072:jJdxYVsvlrk2ycpm1fC/zFJrkWilZ2fkWc6/T+jfOWe2brfnRRQfEfxX6deP:ssvlrxqkpMZwkWc7jf33uEfxqeP
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Soft.exe"C:\Users\Admin\AppData\Local\Temp\Soft.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 21602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1420 -ip 14201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD545e8d7e2f12e256ab90c7ebaa29480e2
SHA14b2ab80cbcae9524f4a2071757cd1653ef909889
SHA256c81da98327d8eaf9b9a0c767668b73dccb34a0b344b8b0c29d1014133cf121d9
SHA512458de9f333b6f300ae5005dc0c93b9681c481c12e4c902b5f460076db61eb33aba7737501a7381e3746aa64e0cb3df776c1e11b783335d7eeb3001afff5b050c
-
Filesize
813B
MD52ce1c791b95adc44eca4c4bd7ace7081
SHA11bb69b748fa1e2554f1ebd00de6c2a1e48b34ad0
SHA2562d3035fc4bfe523ba23b68d4956fabfa9b3924ddfc8e85adf92dd936dbb2d88b
SHA5125390bd8a0a220b8ecd263a2190e6999f9b6f07bae4154422f3348e261d34e9ea8535d95858c5c403d45a55e989beb0fde78c5adbdc486bcea8ecc491bc291cd2
-
Filesize
4KB
MD54d469fcd07d1ee0a57b64c5ad3a80d22
SHA117b0b8600cbe0015c1d3792a05cd5faa69e986e2
SHA2568a90a8506281a7c79e22c746bb5c0e1900753905d39c3b2cf075889f12566f49
SHA5120722c29314d54ec23cee1a7e53009ac9295f54aeb5a59760181233c38c8ef96ce5e141915e20b4ae5c6f1efea13b7952698881fa5e7bed7d7ea7d77047b847a6
-
Filesize
13B
MD552e2479d75e086f9c280ec6ab5ae4fe6
SHA12750d987041c869ebc4be655f31b5803a677fb8b
SHA2567f4007c917578896645f1844af5459e9218c709da14c5465e687ca61604a3de6
SHA512d74deb991dcc9c83c86989040405752caefc9313e5f20ca64fcf1c96a278bfd381ebf58e7ac9fc67aea0e699bdaa915319945ab7a1a0daab3ba4279f9774d1ff
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
176KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
7.7MB