f2b14eda7119d93b5731cc063392bd8e1f6d985b5373fe33af69dddf30af4ef3

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 01:00

Target

0233842bfaad8911785b5ca30aa7e2b3.exe
Size

15.6MB
MD5

0233842bfaad8911785b5ca30aa7e2b3
SHA1

d94607208a2710e2b87c7e006afab4eb91acecf7
SHA256

f2b14eda7119d93b5731cc063392bd8e1f6d985b5373fe33af69dddf30af4ef3
SHA512

2b8ec6e1d8e37d7179f674d9f2f86b347b5a5f7b1e640cdcbb3511fecb506475d9051db3833a2728a308e668cc5e8e984a1f3772ab1dd84d1b661c5093bb6202
SSDEEP

49152:nUk35li1hrb/TwvO90d7HjmAFd4A64nsfJ+PxMkmBZfqFwiQpEmERRzfz1iG7x4F:/i1sDmBZSeSrRRZ+BLzYhTc

Score

6^/10

spyware

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 2264	1360	0233842bfaad8911785b5ca30aa7e2b3.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2264	A3DUtility.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2264	1360	0233842bfaad8911785b5ca30aa7e2b3.exe	28
PID 1360 wrote to memory of 2264	1360	0233842bfaad8911785b5ca30aa7e2b3.exe	28
PID 1360 wrote to memory of 2264	1360	0233842bfaad8911785b5ca30aa7e2b3.exe	28
PID 1360 wrote to memory of 2264	1360	0233842bfaad8911785b5ca30aa7e2b3.exe	28
PID 1360 wrote to memory of 2264	1360	0233842bfaad8911785b5ca30aa7e2b3.exe	28
PID 1360 wrote to memory of 2264	1360	0233842bfaad8911785b5ca30aa7e2b3.exe	28

C:\Users\Admin\AppData\Local\Temp\0233842bfaad8911785b5ca30aa7e2b3.exe
"C:\Users\Admin\AppData\Local\Temp\0233842bfaad8911785b5ca30aa7e2b3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1360-4-0x000000013FAD0000-0x000000013FFD4000-memory.dmp

Filesize
5.0MB

Download
memory/1360-8-0x000000013FAD0000-0x000000013FFD4000-memory.dmp

Filesize
5.0MB

Download
memory/2264-5-0x0000000000110000-0x0000000000197000-memory.dmp

Filesize
540KB

Download
memory/2264-6-0x0000000000110000-0x0000000000197000-memory.dmp

Filesize
540KB

Download
memory/2264-10-0x0000000000110000-0x0000000000197000-memory.dmp

Filesize
540KB

Download
memory/2264-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2264-11-0x0000000000110000-0x0000000000197000-memory.dmp

Filesize
540KB

Download
memory/2264-12-0x0000000000110000-0x0000000000197000-memory.dmp

Filesize
540KB

Download