Analysis

  • max time kernel
    107s
  • max time network
    125s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25-05-2024 11:07

General

  • Target

    9b9438e01b7841dad1cda34aae49f7bc60e09f88ab4e6f639b838e72becf20ab.exe

  • Size

    574KB

  • MD5

    3de3b5b66df61de3be752238d11317e3

  • SHA1

    57d0958ba4da33f65773eb0b45e231f7423fe079

  • SHA256

    9b9438e01b7841dad1cda34aae49f7bc60e09f88ab4e6f639b838e72becf20ab

  • SHA512

    92572d0daf365cba95cc83718d054b6149fd6fa3a1991b545c02423c668c93f9f30ebd86fc0972a29feb5b08576a1d40214fb98926cdc7531499e4e4f0ef91c0

  • SSDEEP

    12288:yr2Ot3stLajVxxEFscjUJoRno+1dXIip6mUrZfmFzOQ84e:s3IIVxxQsFodhdXxacIhP

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b9438e01b7841dad1cda34aae49f7bc60e09f88ab4e6f639b838e72becf20ab.exe
    "C:\Users\Admin\AppData\Local\Temp\9b9438e01b7841dad1cda34aae49f7bc60e09f88ab4e6f639b838e72becf20ab.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3344
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4348

Network

    No results found
  • 5.42.65.67:48396
    RegAsm.exe
    1.7MB
    34.0kB
    1290
    502
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3344-1-0x00000000011F0000-0x00000000011F1000-memory.dmp

    Filesize

    4KB

  • memory/3344-0-0x00000000011F0000-0x00000000011F1000-memory.dmp

    Filesize

    4KB

  • memory/3344-3-0x00000000011F0000-0x00000000011F1000-memory.dmp

    Filesize

    4KB

  • memory/4348-10-0x0000000007CB0000-0x0000000007DBA000-memory.dmp

    Filesize

    1.0MB

  • memory/4348-12-0x0000000007C50000-0x0000000007C8C000-memory.dmp

    Filesize

    240KB

  • memory/4348-5-0x0000000005520000-0x0000000005AC6000-memory.dmp

    Filesize

    5.6MB

  • memory/4348-6-0x0000000004E70000-0x0000000004F02000-memory.dmp

    Filesize

    584KB

  • memory/4348-7-0x0000000074F20000-0x00000000756D1000-memory.dmp

    Filesize

    7.7MB

  • memory/4348-8-0x0000000004F30000-0x0000000004F3A000-memory.dmp

    Filesize

    40KB

  • memory/4348-9-0x0000000008150000-0x0000000008768000-memory.dmp

    Filesize

    6.1MB

  • memory/4348-2-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/4348-11-0x0000000007BF0000-0x0000000007C02000-memory.dmp

    Filesize

    72KB

  • memory/4348-4-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

    Filesize

    4KB

  • memory/4348-13-0x0000000007DC0000-0x0000000007E0C000-memory.dmp

    Filesize

    304KB

  • memory/4348-14-0x0000000007F40000-0x0000000007FA6000-memory.dmp

    Filesize

    408KB

  • memory/4348-15-0x00000000089F0000-0x0000000008A66000-memory.dmp

    Filesize

    472KB

  • memory/4348-16-0x0000000008990000-0x00000000089AE000-memory.dmp

    Filesize

    120KB

  • memory/4348-17-0x0000000009270000-0x0000000009432000-memory.dmp

    Filesize

    1.8MB

  • memory/4348-18-0x0000000009970000-0x0000000009E9C000-memory.dmp

    Filesize

    5.2MB

  • memory/4348-20-0x0000000074F20000-0x00000000756D1000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.