Analysis
- max time kernel
172s - max time network
183s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
17/04/2024, 19:44
General
- Target 7b33c10203120082f771de53577b5ff1d2439419dcf5d721273e5765dba9a9af.exe
- Size 1.8MB
- Sample240417-yfxvjadf41
- SHA256 7b33c10203120082f771de53577b5ff1d2439419dcf5d721273e5765dba9a9af
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b33c10203120082f771de53577b5ff1d2439419dcf5d721273e5765dba9a9af.exe"C:\Users\Admin\AppData\Local\Temp\7b33c10203120082f771de53577b5ff1d2439419dcf5d721273e5765dba9a9af.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
alg.exe
AppVClient.exe
memory/388-225-0x0000000140000000-0x00000001400A9000-memory.dmp
memory/388-101-0x0000000000690000-0x00000000006F0000-memory.dmp
memory/388-94-0x0000000140000000-0x00000001400A9000-memory.dmp
memory/388-93-0x0000000000690000-0x00000000006F0000-memory.dmp
memory/1664-117-0x0000000000900000-0x0000000000960000-memory.dmp
memory/1664-348-0x0000000140000000-0x000000014024B000-memory.dmp
memory/1664-127-0x0000000000900000-0x0000000000960000-memory.dmp
memory/1664-118-0x0000000140000000-0x000000014024B000-memory.dmp
memory/2320-7-0x00000000007A0000-0x0000000000807000-memory.dmp
memory/2320-129-0x0000000000400000-0x00000000005DB000-memory.dmp
memory/2320-1-0x00000000007A0000-0x0000000000807000-memory.dmp
memory/2320-0-0x0000000000400000-0x00000000005DB000-memory.dmp
memory/2320-205-0x0000000000400000-0x00000000005DB000-memory.dmp
memory/3220-209-0x0000000000890000-0x00000000008F0000-memory.dmp
memory/3220-350-0x0000000140000000-0x000000014025D000-memory.dmp
memory/3220-222-0x0000000000890000-0x00000000008F0000-memory.dmp
memory/3220-208-0x0000000140000000-0x000000014025D000-memory.dmp
memory/3332-352-0x0000000140000000-0x00000001400CF000-memory.dmp
memory/3332-244-0x00000000007B0000-0x0000000000810000-memory.dmp
memory/3332-237-0x00000000007B0000-0x0000000000810000-memory.dmp
memory/3332-236-0x0000000140000000-0x00000001400CF000-memory.dmp
memory/3340-231-0x0000000001A70000-0x0000000001AD0000-memory.dmp
memory/3340-215-0x0000000001A70000-0x0000000001AD0000-memory.dmp
memory/3340-213-0x0000000140000000-0x00000001400CF000-memory.dmp
memory/3340-228-0x0000000001A70000-0x0000000001AD0000-memory.dmp
memory/3340-235-0x0000000140000000-0x00000001400CF000-memory.dmp
memory/3420-13-0x00000000006C0000-0x0000000000720000-memory.dmp
memory/3420-212-0x0000000140000000-0x00000001400AA000-memory.dmp
memory/3420-29-0x00000000006C0000-0x0000000000720000-memory.dmp
memory/3420-12-0x0000000140000000-0x00000001400AA000-memory.dmp
memory/5004-106-0x0000000000A10000-0x0000000000A70000-memory.dmp
memory/5004-112-0x0000000000A10000-0x0000000000A70000-memory.dmp
memory/5004-122-0x0000000140000000-0x0000000140135000-memory.dmp
memory/5004-105-0x0000000140000000-0x0000000140135000-memory.dmp
memory/5004-113-0x0000000000A10000-0x0000000000A70000-memory.dmp
memory/5004-119-0x0000000000A10000-0x0000000000A70000-memory.dmp