Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 02:36

General

  • Target

    b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe

  • Size

    17KB

  • MD5

    e1a0d16fb63611d0f93c70162a60e9e3

  • SHA1

    44df1a5a91fae7dab7f894fa0bd35f4f7a1cdb95

  • SHA256

    b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c

  • SHA512

    4d9b9bd7b52985ede9335b16deed8c8d2d8c564aa0be2b39188194a96c35e8966f31f425f044949deb44d83b3fb00100bf677f60a79417215fdc0b4d37937553

  • SSDEEP

    384:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/LK:ljjAQ+BzWPEwnE+KHM2/G

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe
    "C:\Users\Admin\AppData\Local\Temp\b60e9c145eaab63db88cad3eb6f42eb9aa101cf50b67abe8924f55bdeae4e29c.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\vyhxbVMR1GAotK5.exe

    Filesize

    17KB

    MD5

    5d285d5dc9b25a2898607c58d547de68

    SHA1

    c86a0540eec9bf680b984b7f258140e4f56fc1d4

    SHA256

    8a4d8db5276009c0369fc25d83b9e5465e98cbb1f0742a71ecda814cde0c5448

    SHA512

    2f705f7a137d188230bbbb6d0d09e16f3594a675377a96e8c9986a9ee7d2768ee9b9240bcdd797ccd2dc89918d12b4df5f6f01a4d18cd988eb11980e1e96c853

  • C:\Windows\svhost.exe

    Filesize

    16KB

    MD5

    5e7c375139b7453abd0b91a8a220f8e5

    SHA1

    88a3d645fab0f4129c1e485c90b593ab60e469ae

    SHA256

    36ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8

    SHA512

    0805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2