Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/01/2024, 17:24
General
-
Target
806e41d028243acac6aef6ad65be0409.exe
-
Size
1.1MB
-
MD5
806e41d028243acac6aef6ad65be0409
-
SHA1
f5b27bba69e5d48337b91dad56fb188a3cf8f691
-
SHA256
f7db5c030e12d9122b26cf64146a26cdae686c0e7bc388e5d6fba6bb73248471
-
SHA512
961133c342145d55447b7ef2efd09a78c578a20b282b1f39ec6baa90f12258aef5cb6fefa1c5d7e10bed594621a2daa4b302f35ef59d6ccaf7797ade62afcbaf
-
SSDEEP
24576:/kJbS8WYfwDP98n3PG6nQBWTPRxOG/YFFScYFRD3L7OewVIdG3DcWVPfYGDNuu:/kSDp6nQ0TPPqScmCvIde3wG3
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\806e41d028243acac6aef6ad65be0409.exe"C:\Users\Admin\AppData\Local\Temp\806e41d028243acac6aef6ad65be0409.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Jg9iLKLLMeg1aW3.exeC:\Users\Admin\AppData\Local\Temp\Jg9iLKLLMeg1aW3.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
358KB
MD598ad3b487f9354eaacaaf50fd44e5d4e
SHA12209d57f272dcc9e4649d812d9c13b274c502bf2
SHA256dcc29f84c1be27a093d515046e44bdf742053bd484c8300741632016a5417e68
SHA512e29d8f4eca9dabbcdc0c2752c77beb69b3ad5b2d2f3f1868a799ed5a28ed39b477cd667c97728cd375a6b863fac488983576a2add7fcaf6fc5893a3460278408
-
Filesize
1.1MB
MD553baee50f7a69bf3bc0fffe25341a923
SHA10b7998f5517ed4e7c5aeea3a89d73b60d2a2d102
SHA256f91e258ea71dcbfc82371b2ee3e20852e45bef0cb946223d1141a6ef1dfb793f
SHA5120eb28032849f775f604b7064a4f00f7d802c8c2fd5c7bc21b48298e6c3d316286963794b4c6c4981199c21f56b08d9aa466a470d40738d1b633b7feddc8e6241
-
Filesize
945KB
MD5f8c1cda8488083e5dd8f46d7bc010786
SHA14fe5df1b9e315eb63aad0e596cce20125042ccad
SHA256dad05ea6966c5a6a79f8f6ef14d7ee580bfae97ad14e7579670ae4a79d98d8a1
SHA512b4b9de008fedea9a88e4e8427a1fa04a30c09361eb2bcbb649d1a7914b1a06160bad4d9071f7990e951545af08ada424f7b531499174501f02ba6a93de7769b8
-
Filesize
35KB
MD593e5f18caebd8d4a2c893e40e5f38232
SHA1fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6
SHA256a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8
SHA512986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB