Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 04:44

General

  • Target

    8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe

  • Size

    16KB

  • MD5

    2ae5db6e298bac4011aead61ff83c632

  • SHA1

    07b04b3e79a416cdf99384568e97a23861591eb4

  • SHA256

    8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f

  • SHA512

    172f1f3f8cdf8e4dbebb9827f9fc9ef1015f2a70832876cd51325c89d74eb54a13474807f4c796baa620801726783efb22293a9c9ffde081ebf11b3ed7a40190

  • SSDEEP

    384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/POr:IMAQ+BzWPEwnE+KHM2/PE

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe
    "C:\Users\Admin\AppData\Local\Temp\8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4472
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    339KB

    MD5

    cac45b29611e738176e47533a06ca10f

    SHA1

    2a838c4b41f9ec56b2b89193cdd7f141e2413930

    SHA256

    d045e26b0c22f18abeed0686ae74002a6f83d0403e55f854fbfc6b55428936d2

    SHA512

    c7983daf01cb449bcb03d64b88a8bc4d788d13179dabb1d822301c0899717b1b786bc3a8803a19a60c9428522e974b912a2a77997ae0c4e93f1f250e0fa83163

  • C:\Users\Admin\AppData\Local\Temp\ebY0zLu9h1Tf0Vp.exe

    Filesize

    16KB

    MD5

    5b0fa0c3c7ff8d27175edc60acff1308

    SHA1

    97fdcdb4f4ca9677f39593ecb2efef66865cb3c6

    SHA256

    9066f3e4e3966e4af2c7a2e3e969308c989d995afa6e1349015f127493a2a2ff

    SHA512

    76804cee7ecce2e2522a23f537101de454d1b75bbc3456476ab970052b69840d9f501fb1213ee37d8f2dbc6780b22284a88efb9804436eb14f90e474d7535ae5

  • C:\Windows\svhost.exe

    Filesize

    16KB

    MD5

    76fd02b48297edb28940bdfa3fa1c48a

    SHA1

    bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

    SHA256

    07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

    SHA512

    28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0