Analysis
-
max time kernel
168s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/03/2024, 01:57
General
-
Target
933d31dcbd32a9a571efdd4e2138c717e79938438dc0a7e2ce1f4a6a09ccd034.exe
-
Size
705KB
-
MD5
3a7e07aa1a6e8a80891e1f755b5b3373
-
SHA1
bef2045ff96fe059e39f1c9015d074a294f9b7af
-
SHA256
933d31dcbd32a9a571efdd4e2138c717e79938438dc0a7e2ce1f4a6a09ccd034
-
SHA512
0110fb9a0c1b9558fca50d3e583858654ea9de59a060883550281cbe445fea13af7fee7934563e815a7dc7487eb530eafe5385a74f8e86988c103cde124e63ad
-
SSDEEP
12288:fW9B+VWMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:fW9BUSkQ/7Gb8NLEbeZ
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 7 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\933d31dcbd32a9a571efdd4e2138c717e79938438dc0a7e2ce1f4a6a09ccd034.exe"C:\Users\Admin\AppData\Local\Temp\933d31dcbd32a9a571efdd4e2138c717e79938438dc0a7e2ce1f4a6a09ccd034.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4180 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD57726a810c0029c3ecdb81ee745d03e00
SHA1006566841fb1b3dd221d995e65b02c683ceb7844
SHA2560782fcdaeb641f9fcb195814cd2a78ac2db997518b10678d6f916cffbb6b6841
SHA5120e9c17c4fe55cbee86ca112568bb14552b31f3cfdd3477a2088408f59dd4372ff34edee8d046bf8f6c05a1c109024cd425691ba759cca7d68eb02637026ec99c
-
Filesize
521KB
MD565cdf15c89c77a936aec6591972e3779
SHA16480a062d99da75544f1c8db8db3f046fddb2b4f
SHA25698065b186bc91e899574041915046962a7876db374e423e9daffcb5264ca267b
SHA5129a23dd3532dc4b8547d5fa144b62c94334d0b84838e40551b9288fad002b2a86bfc0b40f8d2cb65caecacec00fd5aa30004704fbe1b22b50487a8f2acac05f25
-
Filesize
107KB
MD5bc736a812d6553cb4d3d8bb74c66868c
SHA164dc291f652d333cbd35b1b097bf5cde2ab21558
SHA2565d362286a007645f5560b53c24b2503901150a99f7efa2a12baeada638e05aae
SHA5126cddd77f4231f411937a058dc46dcf121cb67f50e9c9db0cbf57ada6763e54b30f8124c381eee3d3e04191d4c3c17e6ed4ddffbe9d202a7353b03d5c9ca5c90a
-
Filesize
1.2MB
MD5be3e8140edf02c7961d9cac5876a1bba
SHA1de30690a55576ee25c6af26b4ba388f840f1706f
SHA25657457b83d887ab83b4663d6a389b7a68fc6c9d3a3a2a788ecb87c0ff86a056ba
SHA5120b7f056a1f7a4f1a54f697225bb69ca74fce305df8fd2779fb80b0f2217c79a5ab7039af822cecf66eccb94aa2e797e9cd10de5dba6345e14a63f37d018dd9bc
-
Filesize
252KB
MD5e5305e7894c578096d46444c48a13180
SHA155162ac7e1c0ecf334a1b2c3be5d180ab12beafa
SHA2566507a79d2c24a67593b052ae1eae9c3dd77c875d38a005744bdd55dd9040cd80
SHA512bc48de8eb940a6625efd2d7d4d1b9445e30750b6644a29cace25bc0af79d832540419f94490ebf94033b1508bb7145f60113133a53054f7f88b995e9860b61a2
-
Filesize
661KB
MD56bf8abeff9c61a5820b4c7222bf0834e
SHA1489abb26e17a9db014ce2f042fb598ab7d6947b1
SHA2564d1512bc26194854ac1fd6d38c812e5b3e543512f68807b5fdbe40c3dee7f7e8
SHA512732dfe9bdfaf5efd97d8e63b7b310254a76c04cb0bae66d49dd3fb068514d8ed768085306d96051eb7d6b18bee964b8213a195c44a528b446ab8ebb1ed828ef0
-
Filesize
180KB
MD53c8f1c2ae95187e888758467cfe50042
SHA107632b623232c7562a8d5c8150b67a4e961feb6f
SHA256ba4255b7195f10cdc804d37e70aae2d47ff422cd605e56c48f34bc4f8b069c99
SHA512fbdc38c1bb9cc7c44751adec87c53aaf2e6fbded0cd64321df9246879439ebf6af64a6a49e96af05af9fbfe35e8429198ea5790ae6295cb77cf3be2ba8bd67e6
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
384KB