Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 05:36

General

  • Target

    ad75321a09bffb2fbcdab74d1f0869436a5a1cf0c6c7cbacbfaa0c40f06afa7e.exe

  • Size

    17KB

  • MD5

    098dd0c82b3da000009d972c1227af15

  • SHA1

    3f6ff523ecd09fb4b87444576262801bfa2a1007

  • SHA256

    ad75321a09bffb2fbcdab74d1f0869436a5a1cf0c6c7cbacbfaa0c40f06afa7e

  • SHA512

    dfa4410079356a09cea10161fb3651878f9c2816532cdc9a9c2765072b7ad308b5b1d67d31d4dddb6c890e078215b155ff5c9af82caedf0baf9c2c8e0d8a6277

  • SSDEEP

    384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/QoG:IMAQ+BzWPEwnE+KHM2/QoG

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad75321a09bffb2fbcdab74d1f0869436a5a1cf0c6c7cbacbfaa0c40f06afa7e.exe
    "C:\Users\Admin\AppData\Local\Temp\ad75321a09bffb2fbcdab74d1f0869436a5a1cf0c6c7cbacbfaa0c40f06afa7e.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6Mfo8n3YHsAhcuw.exe

    Filesize

    17KB

    MD5

    b93986b7eb78e7553bbdfa911f2d2a13

    SHA1

    b617407349ec7b555da2fc2a3d35545f772a4f4c

    SHA256

    983526fd77867d0e69694d0af891c6b130569dd8339306babb82df22e4dbfefe

    SHA512

    5771de22f23729a39a4e74e75deecf8a9867119b3c6828e4afbe6a1e108e97f4d89b8fe569d15dfd2df703c1ac5b02c20e5a11921bea4973856b7724bd70aa8d

  • C:\Windows\svhost.exe

    Filesize

    16KB

    MD5

    76fd02b48297edb28940bdfa3fa1c48a

    SHA1

    bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

    SHA256

    07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

    SHA512

    28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0