Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11/10/2023, 17:18
General
-
Target
b40dd5b0b5d6317144ced1e756e380b8a1c45edcd1f0a7ff6829345995b427be.exe
-
Size
1.8MB
-
MD5
d5f72f1351b9e3f1d24398460ff052f7
-
SHA1
fb6688793906b9d30e5ee608543ca9bfbfae59b0
-
SHA256
b40dd5b0b5d6317144ced1e756e380b8a1c45edcd1f0a7ff6829345995b427be
-
SHA512
a3ec2c20b6bdd5aeea5aad26742d1a9c1f0ed7d97661d5c4514394f546c50a7804259b327352d9379aeecc406c8997b987e75db7b3c96a7d2f62d8c894295cb5
-
SSDEEP
49152:RK783MoXnFv3dcj7q5LsLp3CceMuczXrjJE3jM2ce:RK78HXnl3dcj7q5KpyceMuczXxE3Xc
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 8 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b40dd5b0b5d6317144ced1e756e380b8a1c45edcd1f0a7ff6829345995b427be.exe"C:\Users\Admin\AppData\Local\Temp\b40dd5b0b5d6317144ced1e756e380b8a1c45edcd1f0a7ff6829345995b427be.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5fa7f110f5831ea7d37cfad3d548c528d
SHA1c1c61777d5ed032a1c87a65d485e1507c08acc3b
SHA2566a1af17103cd436c346d98b87696fcc55e861a21dc0f329104ae6164a55b4076
SHA512fc321e44d8d199a288059526d00065a82630c1473d18e4a80481d3c8bbaa97118e4f967b1d09d050cabcb7a499951b790a7c3c1d0cd1cedb3ebd4ef48f8fee19
-
Filesize
1.6MB
MD5217f336a054fdbb905e8a2a79c65765f
SHA18a30112e67aef4cdc6737609896a664f7651ffe3
SHA2566adccb97204f022e252953fe82061b9d3b79c43617ae51e59f7842d5b5a1142c
SHA512c57e2227dd473d5b8ed37e483e894662ea3a47b79f0432ea3610e246ee6aedbda10592054340541db6c181a013297055f106ab10ecc1a5f439e58db741c7ce73
-
Filesize
1.6MB
MD5fa95106eaef35e6b19f476e6668c9626
SHA1895482896e3e67fe3e73c2eedcef33216fdffc0c
SHA256b74879c4a5676c28e02d994a77b07971ed32ed7e39245ee1ddc3940d67858e5b
SHA51222771205d2f7d32fad81df65f646e9a6364e6442b0fa29288d96a258a98890f61ad2bef1372794ad488be370cfc5a8bee105a981ada8c16a73c3ca7e2f45dc24
-
Filesize
2.1MB
MD53ad4033fcfc9423d755635360926de16
SHA1432006f216c411fcfeb230cf6a048f43c8b20315
SHA2567b0d2c4a13c26bd26da74099631b3d034c0fdce93df4c17b355ce87e38ee63b0
SHA512882dd772cc491764db8fd4903a2464b65a18e1245d37db25b6489a2573ac351a7130a1b83a9808a828d01c3cb060517b3a1aea70e914b9b8c6b146f9a6720cbf
-
Filesize
1.5MB
MD522bc1d481f460b8b6c889d0efcc62c46
SHA1c0cce7610a01e82702bf81a2575d96d7cf01a7e8
SHA2568f780e808c58ca58f4e7e0bdf689ebb3b3a0d6c2c32d9f5bc6494631fb4093b8
SHA512811cb6a0909fcf4c797b01d52d1c5f2d6f93787b60be8d154e06978d01e7271590c7b9c7cf1ca08d82eec5ceb25994480031bfd2597f14cccfedc6c1adeb3bdb
-
Filesize
1.2MB
MD5f256da3d3707ce289ba41bf4f4e85b16
SHA1c0a92ecd10af2105bb4edc38f14510664ebdc8e0
SHA256be50b2698d8f5515a5b154693402f9e023fbdfa9cc3fb94ba4a7280726788891
SHA512d283ccd842dacb04dd6c5709544bb1730fee39650893f2f1cdab99e9311aa9151aad45b57279e8a9840190c8d187e9ed5671c7f22f20d74a09ea9d3cdb12241f
-
Filesize
1.5MB
MD50b484632ec0e7a60ad4648670851eecc
SHA1c3bfc1e943fb71103312e0a121c081940af5815c
SHA256c137f7a105410e5df555570ead0e0b952f6f3bfa60129eb6bed9407b1f346834
SHA51268aa30ee6b0296e6b006422927a0b40172b314f1c4e03e76379ed3567c3c68742f585762a895bd98cee1e8f6b8db66804560cb55ac85cede22bb0d8d848c0554
-
Filesize
1.3MB
MD520537455e2804bad42838858b199668f
SHA19a5612bbf1b02978bf25f711f70ddf1b20e3b0d1
SHA256cf2b4db60d42d29a3ce22f745f8f0fe53226968233bb5e211161bd0068fdb46e
SHA512d30f4c5fe052efd52520ddd3a9e73e05435241d5db92c0a62da614c56da74420a1b5b631b51d913db145395bf9d7c2b8bb075219e59a3e0ac25066f664d98762
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.4MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB