Analysis

  • max time kernel
    133s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 09:36

General

  • Target

    12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe

  • Size

    17KB

  • MD5

    a7154b65cdfde85390a60b287ccc5d0e

  • SHA1

    6663e3aabeaa93fa2af8748c4ccdf4b0c248f075

  • SHA256

    12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2

  • SHA512

    d2bbde8f754cd4b535e33019ceff80d31c9c9776e1331c5fc91c889bdcb596e11df7ac3759c91a91ee7b88eb99d884451a2868c6170d4ede8470d534e4f41cc3

  • SSDEEP

    384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/cION:IMAQ+BzWPEwnE+KHM2/YN

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe
    "C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4232
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
    1⤵
      PID:3580

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

      Filesize

      339KB

      MD5

      bbe24692dcad2285aea0a46dc0703f19

      SHA1

      9d8103e0d837a13d39cbfb767ed95144d3e2f57d

      SHA256

      785cd8cea1625b3397bfd9bc6d1e273302125cc0abefc69ddf1777e15ed0fafd

      SHA512

      daa0e208e7f3879cea296265545376d54f29e64dc3132391c6ee0f820490d00227aba0ff773966d4b6802e30cef1ff8371e9c68e11dd43a8d53b87e170649d9a

    • C:\Users\Admin\AppData\Local\Temp\M4ubijsLqEbFso0.exe

      Filesize

      17KB

      MD5

      d3da8efce89e9311a03c2cf68d96f277

      SHA1

      7a95f3dae012d9e06da67c71e19ea3461ac567ec

      SHA256

      cb987dec7eeb756ed88ea9d0a55f0cf6db23d93e957f0f540719b9cb4938157d

      SHA512

      744487026665e66992cf168eb0fd50849cc88c25ddd300e95ae8f016cc8ca9521634e7a66c44b3838df7d894b4bb6cb2c7c2552e3724afbbb8ceaf830d65a3ee

    • C:\Windows\svhost.exe

      Filesize

      16KB

      MD5

      76fd02b48297edb28940bdfa3fa1c48a

      SHA1

      bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

      SHA256

      07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

      SHA512

      28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0