Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 05:30
Static task
static1
Behavioral task
behavioral1
Sample
fba7a7675a7db49f2e2d06c74912a706.exe
Resource
win7-20240220-en
General
-
Target
fba7a7675a7db49f2e2d06c74912a706.exe
-
Size
571KB
-
MD5
fba7a7675a7db49f2e2d06c74912a706
-
SHA1
65a3f37e4db1b4b4831a69f326041749c823e948
-
SHA256
890fb5416a4320c136a40440a32081b8d31b440250fefc3a8185ccd6005b9700
-
SHA512
9943a94d0f5ff63d01ea952bd6a196dc30ad4d719d1757ad444db52534526902abf90b5df9b1e58acdc3f5fb4a2f11e4df2c37bf380fc50b17be96b294c39411
-
SSDEEP
12288:pqCoQ0GNl9Rq02xC6mV5SmXfJuJ191hyNySM:3RRd2xC6mVoewhoyv
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
fba7a7675a7db49f2e2d06c74912a706.exedescription pid process target process PID 3968 set thread context of 4424 3968 fba7a7675a7db49f2e2d06c74912a706.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
RegAsm.exepid process 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe 4424 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 4424 RegAsm.exe Token: SeBackupPrivilege 4424 RegAsm.exe Token: SeSecurityPrivilege 4424 RegAsm.exe Token: SeSecurityPrivilege 4424 RegAsm.exe Token: SeSecurityPrivilege 4424 RegAsm.exe Token: SeSecurityPrivilege 4424 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
fba7a7675a7db49f2e2d06c74912a706.exedescription pid process target process PID 3968 wrote to memory of 4424 3968 fba7a7675a7db49f2e2d06c74912a706.exe RegAsm.exe PID 3968 wrote to memory of 4424 3968 fba7a7675a7db49f2e2d06c74912a706.exe RegAsm.exe PID 3968 wrote to memory of 4424 3968 fba7a7675a7db49f2e2d06c74912a706.exe RegAsm.exe PID 3968 wrote to memory of 4424 3968 fba7a7675a7db49f2e2d06c74912a706.exe RegAsm.exe PID 3968 wrote to memory of 4424 3968 fba7a7675a7db49f2e2d06c74912a706.exe RegAsm.exe PID 3968 wrote to memory of 4424 3968 fba7a7675a7db49f2e2d06c74912a706.exe RegAsm.exe PID 3968 wrote to memory of 4424 3968 fba7a7675a7db49f2e2d06c74912a706.exe RegAsm.exe PID 3968 wrote to memory of 4424 3968 fba7a7675a7db49f2e2d06c74912a706.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fba7a7675a7db49f2e2d06c74912a706.exe"C:\Users\Admin\AppData\Local\Temp\fba7a7675a7db49f2e2d06c74912a706.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3968-3-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/3968-1-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/3968-0-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/4424-10-0x0000000008920000-0x0000000008A2A000-memory.dmpFilesize
1.0MB
-
memory/4424-12-0x00000000088C0000-0x00000000088FC000-memory.dmpFilesize
240KB
-
memory/4424-5-0x0000000005BA0000-0x0000000006144000-memory.dmpFilesize
5.6MB
-
memory/4424-6-0x0000000005690000-0x0000000005722000-memory.dmpFilesize
584KB
-
memory/4424-7-0x0000000074BF0000-0x00000000753A0000-memory.dmpFilesize
7.7MB
-
memory/4424-8-0x0000000005870000-0x000000000587A000-memory.dmpFilesize
40KB
-
memory/4424-9-0x0000000008DB0000-0x00000000093C8000-memory.dmpFilesize
6.1MB
-
memory/4424-2-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/4424-11-0x0000000008860000-0x0000000008872000-memory.dmpFilesize
72KB
-
memory/4424-4-0x0000000074BFE000-0x0000000074BFF000-memory.dmpFilesize
4KB
-
memory/4424-13-0x0000000008A30000-0x0000000008A7C000-memory.dmpFilesize
304KB
-
memory/4424-14-0x0000000008B30000-0x0000000008B96000-memory.dmpFilesize
408KB
-
memory/4424-15-0x00000000094D0000-0x0000000009546000-memory.dmpFilesize
472KB
-
memory/4424-16-0x0000000008D30000-0x0000000008D4E000-memory.dmpFilesize
120KB
-
memory/4424-17-0x000000000A430000-0x000000000A5F2000-memory.dmpFilesize
1.8MB
-
memory/4424-18-0x000000000AB30000-0x000000000B05C000-memory.dmpFilesize
5.2MB
-
memory/4424-19-0x0000000074BFE000-0x0000000074BFF000-memory.dmpFilesize
4KB
-
memory/4424-20-0x0000000074BF0000-0x00000000753A0000-memory.dmpFilesize
7.7MB
-
memory/4424-22-0x0000000074BF0000-0x00000000753A0000-memory.dmpFilesize
7.7MB