Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 20:23
General
-
Target
3b26c7203716040a82b5dfdee450530a.exe
-
Size
29KB
-
MD5
3b26c7203716040a82b5dfdee450530a
-
SHA1
557adff1267ef7af8c17549d5f6b666e1bd04efd
-
SHA256
eff19d9e1fae68035528644615c9302efd042441a779c09b0fb3bf773623f44b
-
SHA512
475c3bad6f4a2f88573292ec4ffbcff56603a73b7ac6a413ffe5ca57a2986524f757887557a3b85098fb18cce040c8e8e5bd72b40417e1423171fed6969fe7d4
-
SSDEEP
768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEF5ag:SKcR4mjD9r823F5ag
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b26c7203716040a82b5dfdee450530a.exe"C:\Users\Admin\AppData\Local\Temp\3b26c7203716040a82b5dfdee450530a.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD51e8b8b818815bcd10ed0537a7d3f0bd0
SHA164f618f6e940f2b354e77918b0516b5d6b5295d3
SHA2567e80e448172930ac5df02fd72c0561292cf1da98eaad65330f448b0a538faeed
SHA512abda746524f18298128ab0f3b5b8d1e258d08e75d710c4db4f53b5c26e767e00eb2f42823941dc0c5a3558977383e19a78a6ad10cfa7dc857fc0f9a6c0bce041
-
Filesize
29KB
MD51c0da04ae3240c3b9843033bb2fd0957
SHA1415f37f425f1df042cb57ac0d387eff549b756ad
SHA2563626ff21bff72a47953fb0f14c894df9525a9b3b6069959fa3ef8400ebc539cc
SHA5128c1dd73b6d301e34533fb782b5528a7ce18e134dce5329853aa128a61c1760b7fcbf2d118d10a5fe18eb9be4b4cf6bef02f3bd17156e78b8043ffdd1579519ac
-
Filesize
29KB
MD570aa23c9229741a9b52e5ce388a883ac
SHA1b42683e21e13de3f71db26635954d992ebe7119e
SHA2569d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2
SHA512be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB