Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 02:36
Static task
static1
Behavioral task
behavioral1
Sample
b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe
Resource
win10v2004-20240611-en
General
-
Target
b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe
-
Size
17KB
-
MD5
e1a0d16fb63611d0f93c70162a60e9e3
-
SHA1
44df1a5a91fae7dab7f894fa0bd35f4f7a1cdb95
-
SHA256
b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c
-
SHA512
4d9b9bd7b52985ede9335b16deed8c8d2d8c564aa0be2b39188194a96c35e8966f31f425f044949deb44d83b3fb00100bf677f60a79417215fdc0b4d37937553
-
SSDEEP
384:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/LK:ljjAQ+BzWPEwnE+KHM2/G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 2316 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exesvhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" svhost.exe -
Drops file in Windows directory 2 IoCs
Processes:
b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exesvhost.exedescription ioc process File created C:\Windows\svhost.exe b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe File created C:\Windows\svhost.exe svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exesvhost.exedescription pid process Token: SeDebugPrivilege 2860 b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe Token: SeDebugPrivilege 2316 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exedescription pid process target process PID 2860 wrote to memory of 2316 2860 b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe svhost.exe PID 2860 wrote to memory of 2316 2860 b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe svhost.exe PID 2860 wrote to memory of 2316 2860 b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe svhost.exe PID 2860 wrote to memory of 2316 2860 b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe"C:\Users\Admin\AppData\Local\Temp\b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55d285d5dc9b25a2898607c58d547de68
SHA1c86a0540eec9bf680b984b7f258140e4f56fc1d4
SHA2568a4d8db5276009c0369fc25d83b9e5465e98cbb1f0742a71ecda814cde0c5448
SHA5122f705f7a137d188230bbbb6d0d09e16f3594a675377a96e8c9986a9ee7d2768ee9b9240bcdd797ccd2dc89918d12b4df5f6f01a4d18cd988eb11980e1e96c853
-
Filesize
16KB
MD55e7c375139b7453abd0b91a8a220f8e5
SHA188a3d645fab0f4129c1e485c90b593ab60e469ae
SHA25636ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8
SHA5120805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2