Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
13/01/2024, 21:45
General
-
Target
597d8422f001fe20b728f464bda571a2.exe
-
Size
26KB
-
MD5
597d8422f001fe20b728f464bda571a2
-
SHA1
d41f1138e68ca238fea9ce2ddab16d32d2826bff
-
SHA256
178552da93c82cc4fe70de28bf783d0caef530faf67e5e177030b3732e95fa3f
-
SHA512
516cbbdf3b6598b33061206641e0e2d407373f3e94134e7a597b8ed2aa8d9bf96bc0b228efc2d6a19dd42765be9beedecf8719c1abc387419cd3cd3c08e814b8
-
SSDEEP
384:R2OIQ56GBPtDa1FbUCNhnPjka6TGUzrFCCx9HbN6XBjYVGC1FmbFoEsAaQ+CgJ26:lIzl1FbUCNhn91HCx9HBwlbqCCJ2l/A
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\597d8422f001fe20b728f464bda571a2.exe"C:\Users\Admin\AppData\Local\Temp\597d8422f001fe20b728f464bda571a2.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB