Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 12:44
Behavioral task
behavioral1
Sample
c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe
Resource
win7-20240221-en
General
-
Target
c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe
-
Size
1.3MB
-
MD5
d4f7d928f7a5b1d36f89dded39d9c3e0
-
SHA1
8bfaf10334949d19265584c6fc15867b694d0369
-
SHA256
c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423
-
SHA512
e8cdb3313f4a4174d7e924b01ea3822a78f4a8c18d942850bee463c58cdf58d0703d5b80f3737b8df4bf37dee2dc184003810e7515a5e4fb0ea6e0b2d84189a2
-
SSDEEP
24576:Qak/7Nk4RZ45LKZu0zoFmDcpii9iGn+66rLfJIgtEqPILWz8oDqE:Qak/GkZu+k0WdEacJRIo+E
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\W: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\Z: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\I: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\N: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\P: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\S: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\R: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\X: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\Y: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\A: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\E: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\G: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\L: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\Q: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\B: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\J: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\M: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\O: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\H: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\K: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\T: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe File opened (read-only) \??\U: c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 844 c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe Token: SeDebugPrivilege 844 c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe Token: SeDebugPrivilege 1888 c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe Token: SeDebugPrivilege 1888 c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 844 wrote to memory of 1888 844 c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe 91 PID 844 wrote to memory of 1888 844 c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe 91 PID 844 wrote to memory of 1888 844 c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe"C:\Users\Admin\AppData\Local\Temp\c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe"C:\Users\Admin\AppData\Local\Temp\c91ad1414073691bbc7da083090cf091ffe9bc91025a1be93480d48e32d83423.exe" Master2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵PID:3552