Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30/12/2023, 10:00
General
-
Target
1534e2a3888229bafec90ac24b31e432.exe
-
Size
501KB
-
MD5
1534e2a3888229bafec90ac24b31e432
-
SHA1
619a37b247787038735546b25ed4be28ba1c0cfb
-
SHA256
2163537e33e17ae7fdd6e798838cd82ac46069b047b2a45965c9c6db8a16b59f
-
SHA512
8efce3ccf130994c76f9f0e3b932fef62e3ddd15b5a7bd12b3b93a2ee789e1fa6c10741c039e792d7ff50893ed881023e2a4c9207b391d966c6ecbd1187879a8
-
SSDEEP
12288:bh1Lk70TnvjcJy5IoYdPfIUxL7qHQ5w8fyyufdocFn:nk70TrcwfYRn8naypfdlV
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1534e2a3888229bafec90ac24b31e432.exe"C:\Users\Admin\AppData\Local\Temp\1534e2a3888229bafec90ac24b31e432.exe"1⤵
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
135B
MD5be5ecc7a2442bea9d66dce89b0892ebf
SHA19ed36dd33c4d129cd3176ba2e0dcd1e1994952ca
SHA25669247fb4d1b5f12771c7e536cb8b171a0699dccc31407f3a5d094cb77efd8d18
SHA51207f67f55e0c4d02d07c473c2b11bead2ee1711f36902c9a05bb7c700fafcb27335d17d756b8a862fa56f8dc05bdcbda809d04dd9a24fe91773b224124302d1c4
-
Filesize
232B
MD54faad222f8c230c409603b2088bcb4bb
SHA14240b7ec6871c0b8725313ce5d857bf547dde7fb
SHA25618567eb8815c827065d4ec890602b88c21759b6494820433128b605645a10a8e
SHA512ae04d86b298c55addb9bd70491aa5752597abc32bb0f47373c0b0143b02bf6d47fe4f4fb00df7ac8b1136ac1a43227d05339203a678329e3c992276be4966531
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
256KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
464KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
472KB
-
Filesize
456KB
-
Filesize
472KB
-
Filesize
6.9MB