Analysis
-
max time kernel
102s -
max time network
120s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
-
submitted
29/08/2023, 08:35
General
-
Target
Soft.exe
-
Size
230.2MB
-
MD5
3bbde71346cb6e910ca30525dc1e1f60
-
SHA1
1151603635ad94e7651277d92c9f721de05f875b
-
SHA256
58fb993ff17bb718f773fdd43510d77e833c696da2d19cfd2373ce8c0e5e4fcd
-
SHA512
f80e907972099e88c3a1892058bb6fdcfe4ff4e907f48534ad10bd4452ffa399984ba6971221c91075604d450984c5eb57b296f44083481b50cf6d4e8eaa1910
-
SSDEEP
3072:jJdxYVsvlrk2ycpm1fC/zFJrkWilZ2fkWc6/T+jfOWe2brfnRRQfEfxX6deP:ssvlrxqkpMZwkWc7jf33uEfxqeP
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Soft.exe"C:\Users\Admin\AppData\Local\Temp\Soft.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 19482⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c3c7402d2aabdc27df4a8ea35564006b
SHA19bbbd1a2246c720a1d6280ad6692cdd74bba100d
SHA25668df35ca2efc41b85b7e473a6b09f81d1e2403eb0bd9c42a4ed917463a3ae685
SHA51279025126561487168751a5e9b7d971012fe149abf5d6cdfab7da8518cd0951096dd8955bc5fee1c68a89756b1d2fc176010beac00ccbef57f02721d3be727553
-
Filesize
4KB
MD5d0d006d30b759ddefb09c6c97c1f92a7
SHA1b693d71a4426e9d267f1d66c00efdcf59f1833b5
SHA2568a0d55ec3cf47fc5b4454cfe343fef0b98fbead892cbca2af6193432944132ad
SHA5122474eb7e88f80d6482a99edeace37cef7515b98745c844df3f76ebb80f53cd497ef152936a6eadb4909b8fbbfb3373edbc8868391e0f17e7a14ed46b6cd7238e
-
Filesize
4KB
MD5d0d006d30b759ddefb09c6c97c1f92a7
SHA1b693d71a4426e9d267f1d66c00efdcf59f1833b5
SHA2568a0d55ec3cf47fc5b4454cfe343fef0b98fbead892cbca2af6193432944132ad
SHA5122474eb7e88f80d6482a99edeace37cef7515b98745c844df3f76ebb80f53cd497ef152936a6eadb4909b8fbbfb3373edbc8868391e0f17e7a14ed46b6cd7238e
-
Filesize
13B
MD59521abaf63ac62bdebe79b5e57372fab
SHA1413b110169daca1526eab45695ea689dd12a1f52
SHA2569a0b41ea52c5b08a0ccea3309e778f8677b8e8e523e0b75fffa4fbdbbfd6f3c3
SHA5121240645d62741cb3751ba485736b1454e4089cc9c78602e797dcb919ccee6e4ce37a02e0c7a5e8e5ec7da77b4ba6a4746608d3e883327eb403ad2ef0f38a0373
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
5.0MB
-
Filesize
176KB
-
Filesize
408KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
6.9MB