Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    08-06-2024 02:32

General

  • Target

    7d8e93c44d33688d17c996eec60ffba480eade79aed079a66d2396ae044aaa7d.exe

  • Size

    17KB

  • MD5

    4924b6609f89ccf0ccdcf64a5cd4ebe9

  • SHA1

    d8dd5c842d4f79df7ef58c9a0d96cfad5211a6cd

  • SHA256

    7d8e93c44d33688d17c996eec60ffba480eade79aed079a66d2396ae044aaa7d

  • SHA512

    5b90aac1b1b2b8a63d67fc3677c6026b81349a2b85aac5b014575e157832eff6d6183e890841d12fd0502a50851024027e36e78ebc29f4e3a434cbb9bf9b12af

  • SSDEEP

    384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/ZBjRz:IMAQ+BzWPEwnE+KHM2/ZBjh

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d8e93c44d33688d17c996eec60ffba480eade79aed079a66d2396ae044aaa7d.exe
    "C:\Users\Admin\AppData\Local\Temp\7d8e93c44d33688d17c996eec60ffba480eade79aed079a66d2396ae044aaa7d.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rYftmbuchEdKDO0.exe

    Filesize

    17KB

    MD5

    a2531468d0cd763149da1efc527f9c8d

    SHA1

    919daf2d406153719d37f45f62edb6ec4644b401

    SHA256

    f663b02b0c14a0a1a5a30700e5e7377fb0824df519336be776fd6651e3dfccb3

    SHA512

    b2b64d5a5b401a2ff77478db5bd89690594fc4ee55fd0c72fc3288ac5f1a41d7e8a146a222b252b91ba7039c73d3ab3e4f1f143ded83ebf1393bd6c707049b6f

  • C:\Windows\svhost.exe

    Filesize

    16KB

    MD5

    76fd02b48297edb28940bdfa3fa1c48a

    SHA1

    bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

    SHA256

    07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

    SHA512

    28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0