0b97349ab62a3582989a397e3bfb760fac9a40c9b1ccd66762becaa4fe9f6240

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 23:19

Target

0x0007000000022d5d-278.exe
Size

624KB
MD5

2686ac4ee184aa7d3828858ca46484da
SHA1

3dd1955f6c81bf71d4c5af2be05a45c5642c2294
SHA256

89639459a0974d1d066ac1c7721890d4c73198c55952c368264956a56e4f5485
SHA512

d10b7d3b297758cb43abc45088b85822a6f479d8262070f5285fcc75e9c1e4b276ff93a4c54b3949aa639112a850477d42294244dd006a0fde11778bc39980a4
SSDEEP

12288:PKWewyw2dX0HWhWwTZ56Hfnrn9dQCi8y2hmB9bnjqvcOnMaN2VyK:m02dXHV5GxdQr8ronROnL

Score

6^/10

spyware

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 4388	4412	0x0007000000022d5d-278.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4388	AppLaunch.exe
4388	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4388	4412	0x0007000000022d5d-278.exe	89
PID 4412 wrote to memory of 4388	4412	0x0007000000022d5d-278.exe	89
PID 4412 wrote to memory of 4388	4412	0x0007000000022d5d-278.exe	89
PID 4412 wrote to memory of 4388	4412	0x0007000000022d5d-278.exe	89
PID 4412 wrote to memory of 4388	4412	0x0007000000022d5d-278.exe	89
PID 4412 wrote to memory of 4388	4412	0x0007000000022d5d-278.exe	89
PID 4412 wrote to memory of 4388	4412	0x0007000000022d5d-278.exe	89
PID 4412 wrote to memory of 4388	4412	0x0007000000022d5d-278.exe	89
PID 4412 wrote to memory of 4388	4412	0x0007000000022d5d-278.exe	89

C:\Users\Admin\AppData\Local\Temp\0x0007000000022d5d-278.exe
"C:\Users\Admin\AppData\Local\Temp\0x0007000000022d5d-278.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/4388-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4388-1-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4388-2-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4388-3-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4388-4-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download