Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-01-2024 14:50
General
-
Target
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
-
Size
276KB
-
MD5
80d0e4499a2ce6ac1d3bd1d43300c506
-
SHA1
a1ca861aacf0ef8369d7d5a169134c29f895e5ef
-
SHA256
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10
-
SHA512
e67bab4f57deb5f3cb6a227298a19c9f6d96ef0e6825be0ef9f1f3537ca7cc32e9ba4482a5f6e2240b0d6a15ee39061671d6d4928afcfb7feab09009d5e44d30
-
SSDEEP
3072:L6ZBn8Tiju3y8TBz5c3Px/rbtYkHOG0rpPVuwq7fxZ1v:gaijqNcpqful
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe"C:\Users\Admin\AppData\Local\Temp\67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5734458f426553e7d24d18f24124d8bba
SHA10be66eb269b4e38c44ac1c722fa0bbad34661330
SHA256e4f185df07d9c46a1992389609f63e6316d9c69931d4ca309057c218a715a9e9
SHA512225ed8902c5f0613cabcea16b7ce96b19a34a2393e63d2b49b16e7dab731f5ec779e6fbabafbaea530c8174ec3fc7ba369b22767e96eeb02e839f0f1057d75d1
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
344KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
304KB