Analysis
- max time kernel
117s - max time network
120s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
- submitted
05/10/2023, 17:53
General
- Target e9f5cf469606763d6ad1944875076e4d.exe
- Size 343KB
- Sample231005-wgaehsfe46
- SHA256 8cf2e3fd2a1f2522870ac61dc4496433c9700b389768d4b6ef75e905cf5f3421
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9f5cf469606763d6ad1944875076e4d.exe"C:\Users\Admin\AppData\Local\Temp\e9f5cf469606763d6ad1944875076e4d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2152-1-0x00000000006D0000-0x00000000007D0000-memory.dmp
memory/2152-2-0x0000000000400000-0x00000000005CD000-memory.dmp
memory/2152-3-0x0000000000220000-0x0000000000270000-memory.dmp
memory/2152-4-0x00000000021F0000-0x0000000002256000-memory.dmp
memory/2152-5-0x0000000073CE0000-0x00000000743CE000-memory.dmp
memory/2152-6-0x0000000004A20000-0x0000000004A60000-memory.dmp
memory/2152-7-0x0000000004A20000-0x0000000004A60000-memory.dmp
memory/2152-8-0x0000000004960000-0x00000000049C2000-memory.dmp
memory/2152-9-0x0000000004A20000-0x0000000004A60000-memory.dmp
memory/2152-10-0x00000000006D0000-0x00000000007D0000-memory.dmp
memory/2152-11-0x0000000000400000-0x00000000005CD000-memory.dmp
memory/2152-12-0x00000000006D0000-0x00000000007D0000-memory.dmp
memory/2152-13-0x0000000073CE0000-0x00000000743CE000-memory.dmp