Analysis
-
max time kernel
180s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12-10-2023 01:43
General
-
Target
97194ccb29fbdc6824505481bb5efa241d5618102740b8bfc128d1d6ec320f27.exe
-
Size
1.3MB
-
MD5
f46a0735735f929ef0d77cd143ff2230
-
SHA1
9753296b7d5629acbfcfbf661fe17d6255e28089
-
SHA256
97194ccb29fbdc6824505481bb5efa241d5618102740b8bfc128d1d6ec320f27
-
SHA512
3ea706de6b1506ff1c9362691eeb40e8ee0f0ec10460148a1e99abcef3a8a98679e8e1b7f6235db2b4d1670e93ed429b74e7f61bd6cbef78e09bc0ff0259659d
-
SSDEEP
24576:JAdHsPcRJ/z/C1tSUB5sqjnhMgeiCl7G0nehbGZpbD:2dsPIbK1tT9Dmg27RnWGj
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 6 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97194ccb29fbdc6824505481bb5efa241d5618102740b8bfc128d1d6ec320f27.exe"C:\Users\Admin\AppData\Local\Temp\97194ccb29fbdc6824505481bb5efa241d5618102740b8bfc128d1d6ec320f27.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5501d789ae651b65917e8fa86933fe387
SHA1744b3afd93de3af9edf77c0f54afa819451ef802
SHA2568f4d7f589d9817d12329876d0f05a19df515aeb55514af4a3bd35430f401040a
SHA512f7d237aa29e90e77316e990935fd0340fde6f5b304f20f569546ff4c6146d305330b51a759288cd105999df800bd9a18d866ee8fe1cd0c906b7c8b887d8ffd76
-
Filesize
1.4MB
MD5924d74b587c6d24e1530ddf2f34d22bf
SHA10e29d246c31c7f27128312daed1412c05a56f51a
SHA2564e214638f6bb6376d23f51a974a36e0e29205ba7a26e1956f020dd2ebfa9f505
SHA5127287a24e9a8da421c4a1670a0ee0689e1f954f4887d9e085a30984e0094a64701fdb865fa337957dffbf42369a58f0a48607573f6a35528484e6f318ae5a426f
-
Filesize
1.4MB
MD5fa65c216b9948662291bd7986aa4c049
SHA1b5807310e6d51375b183f856e765c1762e5307d1
SHA2563f21e471621527f746e888b4fcdd6162cb7c68500266f19075c01ceed1a1bd3f
SHA51272d9ab1bb90bd1e7c451fbc1d923c52443e92feaf163bf619ecba1a8f5eb2fc0a5825f8d74755a487d9a8053d8834ef90c1caecd274314f042c96ce6f951e733
-
Filesize
2.1MB
MD5affc637ed04b98c55f076891b955d636
SHA183f01a6b38f19171ebcde479be588945a8a4c141
SHA2560add6a9f136d73e4ae7522676d0fa1b74b2d73c5ecd360d4db67c700e3c25bf9
SHA512b3e0914a759d3e7c20c5e87c9c29b202074af7298553d5bdb9989887691283d707ce4da3caf38884e5075328f2b0b38f459626a9084c622bdebe5d4e09a13e75
-
Filesize
1.3MB
MD546e9c17e88a8efb78d0b3894935e7a6c
SHA11ebabd64be4b5105b44cd94d574e42956ade2225
SHA256a45ad96534f79d12d3a1e9353898b2a3e97a802ec29de97b3fa43cce22358be0
SHA512ba6aaabba5f975099a2ac0b2af414054fb631990224d5c33f32721a6ba82ac5d69e104fc8a6dc391505b1ae9a450e429d02d5ee9ba8ca2b560efb8abb29d21f6
-
Filesize
1.3MB
MD5e9f382b763874f64efee36a94c644dc5
SHA1852352cfe2345919ac8c600a08d43e1b473522d7
SHA25630dfeae32c1dab7b1cbd15853691f5a4c9c42ca5b2a9481978b4f6fa83ea237f
SHA51261ddac39423e420028b65a59a177306da1fcedc0f7d3f80e4ed207e73a7acc04e0f08e7e48e8f17bea13b36c45ab3b6d9bee2edac40b3470087303a543c95f2f
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
72KB
-
Filesize
688KB
-
Filesize
80KB
-
Filesize
7.6MB
-
Filesize
632KB
-
Filesize
136KB
-
Filesize
172KB
-
Filesize
176KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
192KB
-
Filesize
1.0MB
-
Filesize
116KB
-
Filesize
196KB
-
Filesize
816KB
-
Filesize
236KB
-
Filesize
1.4MB
-
Filesize
72KB
-
Filesize
124KB
-
Filesize
692KB
-
Filesize
32KB
-
Filesize
340KB
-
Filesize
628KB
-
Filesize
1.6MB
-
Filesize
204KB
-
Filesize
48KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
300KB
-
Filesize
184KB
-
Filesize
620KB
-
Filesize
3.3MB
-
Filesize
384KB
-
Filesize
820KB
-
Filesize
1.3MB
-
Filesize
1.2MB
-
Filesize
576KB
-
Filesize
2.8MB
-
Filesize
384KB
-
Filesize
760KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB