ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
06/07/2024, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f.exe
Size 5.2MB
Sample240706-gllwsazfkc
SHA256 ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f
MD5 f2a5c7e8313862aca9b7a6314ca73f3a
SHA1 dd9f9c6d3dfc2805e8851676679cd9734a877eea
SHA512 a459adc6ce2cc9d19672894de1df41228da0b072bbbd67493b7a1d3b57cd491c0c62b7e842e1d7306719e889fe777b915b3de274f4dad52ba5ba601783e79a13
SSDEEP 49152:Z6dH/1E4lojlIfw68P9//EctarfVW7c9PqoEv0V8jM5ERIcRjtS7HU4sOThLJG+6:E9tzQIUhZh7cJxEIZJX6
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 3956	2064	ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3956	BitLockerToGo.exe
3956	BitLockerToGo.exe
3956	BitLockerToGo.exe
3956	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3956	2064	ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f.exe	82
PID 2064 wrote to memory of 3956	2064	ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f.exe	82
PID 2064 wrote to memory of 3956	2064	ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f.exe	82
PID 2064 wrote to memory of 3956	2064	ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f.exe	82
PID 2064 wrote to memory of 3956	2064	ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f.exe	82

C:\Users\Admin\AppData\Local\Temp\ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f.exe
"C:\Users\Admin\AppData\Local\Temp\ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-4-0x00007FF6F3870000-0x00007FF6F3E01000-memory.dmp

Download

memory/2064-6-0x00007FF6F3870000-0x00007FF6F3E01000-memory.dmp

Download

memory/3956-5-0x0000000000330000-0x0000000000387000-memory.dmp

Download

memory/3956-8-0x0000000000330000-0x0000000000387000-memory.dmp

Download

memory/3956-9-0x0000000000330000-0x0000000000387000-memory.dmp

Download

memory/3956-10-0x0000000000330000-0x0000000000387000-memory.dmp

Download