Analysis

  • max time kernel
    59s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-03-2024 15:07

General

  • Target

    Project.exe

  • Size

    147.0MB

  • MD5

    5fff4c7f41fe8a04f7c6ffcb191bfd54

  • SHA1

    e660df9a92442e6a91e0805b3310a94bde5fe414

  • SHA256

    4aba8d9303ced281e6b884dbb045582d9bf24405ced912fb9aeb97335ffe483d

  • SHA512

    7cd6010c78c81f5a9234f3a5849d4c7bc3896a537fd3c4030976f29cabf16aeb331a88c4186fd0bb2edc9b56fa6551065c247a0ca05084aaa72ddfab75d0ff14

  • SSDEEP

    1572864:QroLm1cZ4K5MvHwpkeg9duXYFPEiFWITK886rc028B+yJwG5xmR:FCjwAI8xO

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Project.exe
    "C:\Users\Admin\AppData\Local\Temp\Project.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\Project.exe
      "C:\Users\Admin\AppData\Local\Temp\Project.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 --field-trial-handle=1132,i,13942639485619888158,2911610544392860811,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2644
      • C:\Users\Admin\AppData\Local\Temp\Project.exe
        "C:\Users\Admin\AppData\Local\Temp\Project.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --mojo-platform-channel-handle=1580 --field-trial-handle=1132,i,13942639485619888158,2911610544392860811,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:2112
        • C:\Users\Admin\AppData\Local\Temp\Project.exe
          "C:\Users\Admin\AppData\Local\Temp\Project.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1132,i,13942639485619888158,2911610544392860811,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          2⤵
            PID:3060

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\77bbf260-cd3c-4aca-bf80-8612e85cca9c.tmp.node
          Filesize

          1.8MB

          MD5

          3072b68e3c226aff39e6782d025f25a8

          SHA1

          cf559196d74fa490ac8ce192db222c9f5c5a006a

          SHA256

          7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01

          SHA512

          61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61

        • \Users\Admin\AppData\Local\Temp\821d502b-68ac-42c2-bd97-4d65fa990145.tmp.node
          Filesize

          134KB

          MD5

          109624345394b9641a2dee876c3c354f

          SHA1

          31d960ef30dca42c7e97c1bb36dd50a1bf0c72d4

          SHA256

          4450d61845c86710fa7f3f98c77469f2c4a7478c04184c20c0fed589a3e4b52e

          SHA512

          382a77c62d8ec1150a055bae9b579279344d0a70d579ceaff137818bbbe77f392f98f334ce3bf33cb3c3547d57202426350fca0f713bd3912db5f17979a3d40c

        • memory/2644-10-0x0000000000060000-0x0000000000061000-memory.dmp
          Filesize

          4KB

        • memory/2644-40-0x00000000774A0000-0x00000000774A1000-memory.dmp
          Filesize

          4KB