Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
29-08-2023 08:35
General
-
Target
Soft.exe
-
Size
230.2MB
-
MD5
3bbde71346cb6e910ca30525dc1e1f60
-
SHA1
1151603635ad94e7651277d92c9f721de05f875b
-
SHA256
58fb993ff17bb718f773fdd43510d77e833c696da2d19cfd2373ce8c0e5e4fcd
-
SHA512
f80e907972099e88c3a1892058bb6fdcfe4ff4e907f48534ad10bd4452ffa399984ba6971221c91075604d450984c5eb57b296f44083481b50cf6d4e8eaa1910
-
SSDEEP
3072:jJdxYVsvlrk2ycpm1fC/zFJrkWilZ2fkWc6/T+jfOWe2brfnRRQfEfxX6deP:ssvlrxqkpMZwkWc7jf33uEfxqeP
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 36 IoCs
-
Suspicious use of SendNotifyMessage 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Soft.exe"C:\Users\Admin\AppData\Local\Temp\Soft.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5694c5ffccb77670978cd3f14529ea6b1
SHA17ab23fdd9cef4b2088405f533eabfdad5b64354c
SHA25690cb6125d7a10b2c0a0b6e12e8ba0634b685fd5f43e72ad98a972b488f070c7a
SHA512d09e1803bda281b0b8990a24b1a87888a2595253c2801b066d7b10825eaacd7494412e015692c4a46ae89ead3382f5d28c913bbf73f8ff92584cea312675dea1
-
Filesize
4KB
MD50deddb3cd02f97a1b29228e249b3b365
SHA1fecda2c925798a04ad17871124a441dd96ae1730
SHA256f347f9e4d3dd0ce266a5d225c0471e33386c659c6c2425a1b2e625864e538b9b
SHA51223d186926572a79bd7cec17ddfc8dc49e97097636cf34cdbc4a8b3d6b590362635cb41200da96385cbc9da4d255cef65bf5bf2cd964c37c331ef9d1dec50eeb0
-
Filesize
13B
MD59521abaf63ac62bdebe79b5e57372fab
SHA1413b110169daca1526eab45695ea689dd12a1f52
SHA2569a0b41ea52c5b08a0ccea3309e778f8677b8e8e523e0b75fffa4fbdbbfd6f3c3
SHA5121240645d62741cb3751ba485736b1454e4089cc9c78602e797dcb919ccee6e4ce37a02e0c7a5e8e5ec7da77b4ba6a4746608d3e883327eb403ad2ef0f38a0373
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
176KB
-
Filesize
256KB
-
Filesize
120KB
-
Filesize
256KB
-
Filesize
6.9MB