Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 17:41
General
-
Target
31af318a5eae1287b275f8f735d960d3.exe
-
Size
178KB
-
MD5
31af318a5eae1287b275f8f735d960d3
-
SHA1
f8f754bd0433cf29c3023c3e618a10bc4e3a7a59
-
SHA256
e5b5eabcbe3fe2d8b41d06989a4ec4987e8884e375c6d0b763a87a135ac9663d
-
SHA512
ba464caddd31d9ab17a8879f4ca0a8b038a1cc015fdaa1874b15f1b0d487658793c9b06c8a559872b250989f8fd4ee9c3e8fb12238f51984638fadafc5161a5d
-
SSDEEP
3072:DFzxR/YSMF8LhrsCS+pZrBW+02NG9C35fMuDyEZOEVrj0C/pq6914fNO:DP97MGxsCS/+0oGu5fzAEVA64fNO
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\31af318a5eae1287b275f8f735d960d3.exe"C:\Users\Admin\AppData\Local\Temp\31af318a5eae1287b275f8f735d960d3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Recycle.Bin\Recycle.Bin.exe"C:\Recycle.Bin\Recycle.Bin.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aEe68D1.exe"C:\Users\Admin\AppData\Local\Temp\aEe68D1.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD54e3807d84f0a96c35320e3488297dbd1
SHA19fed69c0766609b64ae88948e96c0b256d1036b9
SHA25649e60fcfb09dc5dc0f8b97d55a5315c43c69109c4cd6c9a630f0a5e90e298a18
SHA512fffb2d2c9dd399183c8393b8c7fae355f9ff0082b86baabe16b291d26315fb8160db0541d47a3d08e7187cb5b9650fed79ff7a11c28e4d0ac2acbf54fcae7f37
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
Filesize
178KB
MD531af318a5eae1287b275f8f735d960d3
SHA1f8f754bd0433cf29c3023c3e618a10bc4e3a7a59
SHA256e5b5eabcbe3fe2d8b41d06989a4ec4987e8884e375c6d0b763a87a135ac9663d
SHA512ba464caddd31d9ab17a8879f4ca0a8b038a1cc015fdaa1874b15f1b0d487658793c9b06c8a559872b250989f8fd4ee9c3e8fb12238f51984638fadafc5161a5d
-
Filesize
308KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
368KB
-
Filesize
308KB
-
Filesize
12KB
-
Filesize
308KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
368KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
308KB
-
Filesize
368KB
-
Filesize
308KB
-
Filesize
368KB
-
Filesize
1024KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
8KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
8KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
16KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
24KB
-
Filesize
212KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1024KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
212KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
212KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB