Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 07:00

General

  • Target

    SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe

  • Size

    56KB

  • MD5

    7c7ade1083e118986c4f049523ccb3c8

  • SHA1

    a861989b4106dd1b73c12fbfb048d8f285c48641

  • SHA256

    8a464e38787861dbcc21e719d509cc4534a013ea9cc9d4ff2c849d33c21db3cd

  • SHA512

    838da41f8d18ae3703ff66c5c089000362d3d16d6026f1ec6e99751f34fa26ddf332f231fb241b363d72637538ceb2bf5651f751697763900ffff716f7fe517c

  • SSDEEP

    768:lv8GjOdyiZNATDkTglSJ520ocooyj+z0L64dvPGZBgb2o:yG6dyiZGkmS2PcRzWPbb2o

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ihatenarbs

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe
    "C:\Users\Admin\AppData\Local\Temp\SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4744-0-0x000000001B530000-0x000000001B5D6000-memory.dmp

    Filesize

    664KB

  • memory/4744-1-0x00007FFBAE730000-0x00007FFBAF0D1000-memory.dmp

    Filesize

    9.6MB

  • memory/4744-2-0x0000000000E20000-0x0000000000E30000-memory.dmp

    Filesize

    64KB

  • memory/4744-3-0x000000001BAB0000-0x000000001BF7E000-memory.dmp

    Filesize

    4.8MB

  • memory/4744-4-0x00007FFBAE730000-0x00007FFBAF0D1000-memory.dmp

    Filesize

    9.6MB

  • memory/4744-5-0x000000001C020000-0x000000001C0BC000-memory.dmp

    Filesize

    624KB

  • memory/4744-6-0x0000000000D90000-0x0000000000D98000-memory.dmp

    Filesize

    32KB

  • memory/4744-7-0x0000000000E20000-0x0000000000E30000-memory.dmp

    Filesize

    64KB

  • memory/4744-8-0x00007FFBAE730000-0x00007FFBAF0D1000-memory.dmp

    Filesize

    9.6MB

  • memory/4744-9-0x0000000000E20000-0x0000000000E30000-memory.dmp

    Filesize

    64KB