Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 04:36
Static task
static1
Behavioral task
behavioral1
Sample
5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe
Resource
win10v2004-20240611-en
General
-
Target
5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe
-
Size
17KB
-
MD5
7ae111fdce3b99f728c3d517cbe6aed1
-
SHA1
c2e08075bd5df79a035ff05555a9b7d51fee761c
-
SHA256
5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661
-
SHA512
57d41b958b49fd1e41afc47db518e14a2f5d5ad63d0433023995e0b3ad763eed58f91a4e780b898c971c67fbcf73ceb8f97f2fbdd459177f70164078cfde1848
-
SSDEEP
384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/XCnBf:IMAQ+BzWPEwnE+KHM2/XCBf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 1724 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exesvhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" 5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" svhost.exe -
Drops file in Windows directory 2 IoCs
Processes:
5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exesvhost.exedescription ioc process File created C:\Windows\svhost.exe 5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe File created C:\Windows\svhost.exe svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exesvhost.exedescription pid process Token: SeDebugPrivilege 2476 5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe Token: SeDebugPrivilege 1724 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exedescription pid process target process PID 2476 wrote to memory of 1724 2476 5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe svhost.exe PID 2476 wrote to memory of 1724 2476 5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe svhost.exe PID 2476 wrote to memory of 1724 2476 5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe svhost.exe PID 2476 wrote to memory of 1724 2476 5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe"C:\Users\Admin\AppData\Local\Temp\5769d0e90af5997fb3e2b480ca246714dd691952e884661dcae843b67931d661.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5584511a294def0b7c3e4dcaceda7f8cf
SHA19e4af37a4a69c977eb02bccf1a743b6848be00f6
SHA2567eed3a95a3bd89093d8725a90d7e354d76fdceb069da65adf3aa419a32546d73
SHA5122dbf54f8eb17624d0b2592c8281502060b7bf5462dc4dd95b02d53d063713c310d0041691152dde6eeb7287e7ea9b26eeba80a4434afcb99377820997e7216db
-
Filesize
16KB
MD576fd02b48297edb28940bdfa3fa1c48a
SHA1bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA25607abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
SHA51228c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0