3d7066dda89f31d017e8d9cb6131f14f3aab9ec7cdb8d997a7d8198adf197180

Analysis

max time kernel
205s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c4d558acc94162490f5048e29fdba96f.exe
Size

410KB
MD5

c4d558acc94162490f5048e29fdba96f
SHA1

62c3e55c500a5ec72568591ea7873288951c7b25
SHA256

3d7066dda89f31d017e8d9cb6131f14f3aab9ec7cdb8d997a7d8198adf197180
SHA512

5d52359e0f90a4ddc997ff95beead7024d761cf5d0bde2195ca237eea0a836de949ba8dfb390ffaf8e97b0bee5a7d2d3df7b268bb6bfd4b337d436ff5c3c3cb5
SSDEEP

12288:rHaDwqMZ+R4hPhhscC9AcUYxDSA6hieEn1dvXB9XR77ir6Nmu91eLfKPSSP3v/qr:r6Yb

Score

8^/10

spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 3 IoCs

pid	Process
1184	c4d558acc94162490f5048e29fdba96f.exe
1184	c4d558acc94162490f5048e29fdba96f.exe
1184	c4d558acc94162490f5048e29fdba96f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1184	c4d558acc94162490f5048e29fdba96f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	c4d558acc94162490f5048e29fdba96f.exe

C:\Users\Admin\AppData\Local\Temp\c4d558acc94162490f5048e29fdba96f.exe
"C:\Users\Admin\AppData\Local\Temp\c4d558acc94162490f5048e29fdba96f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll

Filesize
384KB

MD5
55c797383dbbbfe93c0fe3215b99b8ec

SHA1
1b089157f3d8ae64c62ea15cdad3d82eafa1df4b

SHA256
5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d

SHA512
648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757

Download Submit
C:\Users\Admin\AppData\Local\Temp\x86\SQLite.Interop.dll

Filesize
1.3MB

MD5
8be215abf1f36aa3d23555a671e7e3be

SHA1
547d59580b7843f90aaca238012a8a0c886330e6

SHA256
83f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae

SHA512
38cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b

Download Submit
memory/1184-16-0x0000000000960000-0x0000000000972000-memory.dmp

Filesize
72KB

Download
memory/1184-17-0x0000000006300000-0x00000000064C2000-memory.dmp

Filesize
1.8MB

Download
memory/1184-4-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/1184-5-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/1184-6-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/1184-15-0x0000000006090000-0x0000000006122000-memory.dmp

Filesize
584KB

Download
memory/1184-0-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1184-3-0x00000000054E0000-0x0000000005A84000-memory.dmp

Filesize
5.6MB

Download
memory/1184-2-0x0000000004E30000-0x0000000004E4A000-memory.dmp

Filesize
104KB

Download
memory/1184-21-0x0000000006800000-0x0000000006862000-memory.dmp

Filesize
392KB

Download
memory/1184-22-0x0000000006870000-0x0000000006BC4000-memory.dmp

Filesize
3.3MB

Download
memory/1184-23-0x00000000067A0000-0x00000000067EC000-memory.dmp

Filesize
304KB

Download
memory/1184-1-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/1184-29-0x0000000006610000-0x000000000664C000-memory.dmp

Filesize
240KB

Download
memory/1184-30-0x00000000065D0000-0x00000000065F1000-memory.dmp

Filesize
132KB

Download