Analysis
-
max time kernel
137s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 03:39
Static task
static1
Behavioral task
behavioral1
Sample
b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe
Resource
win10v2004-20240226-en
General
-
Target
b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe
-
Size
16KB
-
MD5
ce4e561c47dea3b2ff87dcc2d8dfbccf
-
SHA1
fa317b3d227017415c73145ccea965315309f289
-
SHA256
b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d
-
SHA512
83e14ca39042dc7ce7ae08d7dbdc889a35aa1e81c1da9b2bc931e8e57063c2a2242768d29e575e042771498ad5f443b6c7275c124c450a8c8daac4dc11bf5404
-
SSDEEP
384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/qL:IMAQ+BzWPEwnE+KHM2/m
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 4664 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exesvhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" svhost.exe -
Drops file in Windows directory 2 IoCs
Processes:
svhost.exeb6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exedescription ioc process File created C:\Windows\svhost.exe svhost.exe File created C:\Windows\svhost.exe b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exesvhost.exedescription pid process Token: SeDebugPrivilege 332 b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe Token: SeDebugPrivilege 4664 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exedescription pid process target process PID 332 wrote to memory of 4664 332 b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe svhost.exe PID 332 wrote to memory of 4664 332 b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe svhost.exe PID 332 wrote to memory of 4664 332 b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe"C:\Users\Admin\AppData\Local\Temp\b6d6666ca9f0e419b8258dde61646076d1fc1c9442542296c84196dbf6a7e83d.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:1472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlFilesize
734KB
MD59b55ded8943adb98deab6a200ab9cc16
SHA1fadcddf1fdd191a8f30c4fa4ea4e5e44bc71f7f1
SHA25635bac87ebe142b8c36d7707646287cdf200bde36863be0d4b50f5e3dcef28bf6
SHA512e7934ab834dfd57954f2930293f4268e82c5e648db7cbfa21d0c7db7ae70d94c8396f8892d20cee11d95f1215bde61793dc0d78591ecbec600334aa1e2b69688
-
C:\Users\Admin\AppData\Local\Temp\AgFxrPAW6YK6S8B.exeFilesize
16KB
MD5edea48da339aed1f09d91dde96cca7ac
SHA1f29decfa9909c11c18496442b63f97697ad1c018
SHA256954aa2c1b951f9e6dc01ed8456c48009a41384e1d186af9f6e3f7af92e051a07
SHA51216f6ae24357a2a5ede82a481a57f6591298c5a6868833b04d77e43778373fe7d0ac707f68363454d077483016abf72c1084bb70e2a25021413487f3d62c12069
-
C:\Windows\svhost.exeFilesize
16KB
MD576fd02b48297edb28940bdfa3fa1c48a
SHA1bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA25607abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
SHA51228c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0