Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
31/12/2023, 04:03
General
- Target 27603266be7833e70754950f5e6e3ff4.exe
- Size 186KB
- Sample231231-emrsbafbfr
- SHA256 799f68557a96a989f734a4049cce6f79efb0cc846c3765c57ffa68b7df28e6d1
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27603266be7833e70754950f5e6e3ff4.exe"C:\Users\Admin\AppData\Local\Temp\27603266be7833e70754950f5e6e3ff4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27603266be7833e70754950f5e6e3ff4.exeC:\Users\Admin\AppData\Local\Temp\27603266be7833e70754950f5e6e3ff4.exe startC:\Program Files (x86)\Internet Explorer\D3A0\EFF.exe%C:\Program Files (x86)\Internet Explorer\D3A02⤵
-
-
C:\Users\Admin\AppData\Local\Temp\27603266be7833e70754950f5e6e3ff4.exeC:\Users\Admin\AppData\Local\Temp\27603266be7833e70754950f5e6e3ff4.exe startC:\Users\Admin\AppData\Roaming\0D935\48ED3.exe%C:\Users\Admin\AppData\Roaming\0D9352⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
523A.D93
523A.D93
memory/3976-12-0x0000000000400000-0x0000000000453000-memory.dmp
memory/3976-14-0x0000000000400000-0x0000000000453000-memory.dmp
memory/3976-13-0x0000000000670000-0x0000000000770000-memory.dmp
memory/4796-38-0x0000000000400000-0x0000000000453000-memory.dmp
memory/4796-1-0x0000000000400000-0x0000000000453000-memory.dmp
memory/4796-105-0x0000000000660000-0x0000000000760000-memory.dmp
memory/4796-2-0x0000000000660000-0x0000000000760000-memory.dmp
memory/4796-168-0x0000000000400000-0x0000000000453000-memory.dmp
memory/4796-169-0x0000000000400000-0x0000000000453000-memory.dmp
memory/4952-103-0x0000000000610000-0x000000000062A000-memory.dmp
memory/4952-102-0x0000000000400000-0x0000000000453000-memory.dmp