Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 09:36
Static task
static1
Behavioral task
behavioral1
Sample
12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe
Resource
win10v2004-20240508-en
General
-
Target
12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe
-
Size
17KB
-
MD5
a7154b65cdfde85390a60b287ccc5d0e
-
SHA1
6663e3aabeaa93fa2af8748c4ccdf4b0c248f075
-
SHA256
12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2
-
SHA512
d2bbde8f754cd4b535e33019ceff80d31c9c9776e1331c5fc91c889bdcb596e11df7ac3759c91a91ee7b88eb99d884451a2868c6170d4ede8470d534e4f41cc3
-
SSDEEP
384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/cION:IMAQ+BzWPEwnE+KHM2/YN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 4232 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exesvhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" svhost.exe -
Drops file in Windows directory 2 IoCs
Processes:
12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exesvhost.exedescription ioc process File created C:\Windows\svhost.exe 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe File created C:\Windows\svhost.exe svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exesvhost.exedescription pid process Token: SeDebugPrivilege 4760 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe Token: SeDebugPrivilege 4232 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exedescription pid process target process PID 4760 wrote to memory of 4232 4760 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe svhost.exe PID 4760 wrote to memory of 4232 4760 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe svhost.exe PID 4760 wrote to memory of 4232 4760 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe"C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:81⤵PID:3580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339KB
MD5bbe24692dcad2285aea0a46dc0703f19
SHA19d8103e0d837a13d39cbfb767ed95144d3e2f57d
SHA256785cd8cea1625b3397bfd9bc6d1e273302125cc0abefc69ddf1777e15ed0fafd
SHA512daa0e208e7f3879cea296265545376d54f29e64dc3132391c6ee0f820490d00227aba0ff773966d4b6802e30cef1ff8371e9c68e11dd43a8d53b87e170649d9a
-
Filesize
17KB
MD5d3da8efce89e9311a03c2cf68d96f277
SHA17a95f3dae012d9e06da67c71e19ea3461ac567ec
SHA256cb987dec7eeb756ed88ea9d0a55f0cf6db23d93e957f0f540719b9cb4938157d
SHA512744487026665e66992cf168eb0fd50849cc88c25ddd300e95ae8f016cc8ca9521634e7a66c44b3838df7d894b4bb6cb2c7c2552e3724afbbb8ceaf830d65a3ee
-
Filesize
16KB
MD576fd02b48297edb28940bdfa3fa1c48a
SHA1bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA25607abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
SHA51228c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0