Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 04:44
Static task
static1
Behavioral task
behavioral1
Sample
8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe
Resource
win10v2004-20240508-en
General
-
Target
8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe
-
Size
16KB
-
MD5
2ae5db6e298bac4011aead61ff83c632
-
SHA1
07b04b3e79a416cdf99384568e97a23861591eb4
-
SHA256
8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f
-
SHA512
172f1f3f8cdf8e4dbebb9827f9fc9ef1015f2a70832876cd51325c89d74eb54a13474807f4c796baa620801726783efb22293a9c9ffde081ebf11b3ed7a40190
-
SSDEEP
384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/POr:IMAQ+BzWPEwnE+KHM2/PE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 1988 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exesvhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" 8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" svhost.exe -
Drops file in Windows directory 2 IoCs
Processes:
8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exesvhost.exedescription ioc process File created C:\Windows\svhost.exe 8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe File created C:\Windows\svhost.exe svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exesvhost.exedescription pid process Token: SeDebugPrivilege 4472 8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe Token: SeDebugPrivilege 1988 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exedescription pid process target process PID 4472 wrote to memory of 1988 4472 8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe svhost.exe PID 4472 wrote to memory of 1988 4472 8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe svhost.exe PID 4472 wrote to memory of 1988 4472 8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe"C:\Users\Admin\AppData\Local\Temp\8d190a12f39b0afd242ce719f1071e037494fca8f506487ef1723f021a99a41f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339KB
MD5cac45b29611e738176e47533a06ca10f
SHA12a838c4b41f9ec56b2b89193cdd7f141e2413930
SHA256d045e26b0c22f18abeed0686ae74002a6f83d0403e55f854fbfc6b55428936d2
SHA512c7983daf01cb449bcb03d64b88a8bc4d788d13179dabb1d822301c0899717b1b786bc3a8803a19a60c9428522e974b912a2a77997ae0c4e93f1f250e0fa83163
-
Filesize
16KB
MD55b0fa0c3c7ff8d27175edc60acff1308
SHA197fdcdb4f4ca9677f39593ecb2efef66865cb3c6
SHA2569066f3e4e3966e4af2c7a2e3e969308c989d995afa6e1349015f127493a2a2ff
SHA51276804cee7ecce2e2522a23f537101de454d1b75bbc3456476ab970052b69840d9f501fb1213ee37d8f2dbc6780b22284a88efb9804436eb14f90e474d7535ae5
-
Filesize
16KB
MD576fd02b48297edb28940bdfa3fa1c48a
SHA1bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA25607abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
SHA51228c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0