f2b14eda7119d93b5731cc063392bd8e1f6d985b5373fe33af69dddf30af4ef3

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 01:00

Target

0233842bfaad8911785b5ca30aa7e2b3.exe
Size

15.6MB
MD5

0233842bfaad8911785b5ca30aa7e2b3
SHA1

d94607208a2710e2b87c7e006afab4eb91acecf7
SHA256

f2b14eda7119d93b5731cc063392bd8e1f6d985b5373fe33af69dddf30af4ef3
SHA512

2b8ec6e1d8e37d7179f674d9f2f86b347b5a5f7b1e640cdcbb3511fecb506475d9051db3833a2728a308e668cc5e8e984a1f3772ab1dd84d1b661c5093bb6202
SSDEEP

49152:nUk35li1hrb/TwvO90d7HjmAFd4A64nsfJ+PxMkmBZfqFwiQpEmERRzfz1iG7x4F:/i1sDmBZSeSrRRZ+BLzYhTc

Score

6^/10

spyware

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 824	4496	0233842bfaad8911785b5ca30aa7e2b3.exe	95

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
824	ADelRCP.exe
824	ADelRCP.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 824	4496	0233842bfaad8911785b5ca30aa7e2b3.exe	95
PID 4496 wrote to memory of 824	4496	0233842bfaad8911785b5ca30aa7e2b3.exe	95
PID 4496 wrote to memory of 824	4496	0233842bfaad8911785b5ca30aa7e2b3.exe	95
PID 4496 wrote to memory of 824	4496	0233842bfaad8911785b5ca30aa7e2b3.exe	95
PID 4496 wrote to memory of 824	4496	0233842bfaad8911785b5ca30aa7e2b3.exe	95

C:\Users\Admin\AppData\Local\Temp\0233842bfaad8911785b5ca30aa7e2b3.exe
"C:\Users\Admin\AppData\Local\Temp\0233842bfaad8911785b5ca30aa7e2b3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:824

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/824-8-0x0000000000760000-0x00000000007E7000-memory.dmp

Filesize
540KB

Download
memory/824-10-0x0000000000760000-0x00000000007E7000-memory.dmp

Filesize
540KB

Download
memory/824-7-0x0000000000760000-0x00000000007E7000-memory.dmp

Filesize
540KB

Download
memory/824-5-0x0000000000760000-0x00000000007E7000-memory.dmp

Filesize
540KB

Download
memory/4496-4-0x00007FF70E780000-0x00007FF70EC84000-memory.dmp

Filesize
5.0MB

Download
memory/4496-6-0x00007FF70E780000-0x00007FF70EC84000-memory.dmp

Filesize
5.0MB

Download