Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-08-2024 01:45
General
-
Target
d5fc2290b834e2afe0c28835224182a678c74ae058f7e578d25e729bbfa1d98a.exe
-
Size
1.7MB
-
MD5
2a4a39e6166cad7577b81c33bba269ea
-
SHA1
2fa5a435112cd4a03d03424cee2e56c3d54d6b38
-
SHA256
d5fc2290b834e2afe0c28835224182a678c74ae058f7e578d25e729bbfa1d98a
-
SHA512
4e1959c5f64cfaa002dc3a29d7d7cc862fd0ade383f9ecd4180e4785ed850ef47fd66603ac124a57763bdeb971c9da47b074a2670af43ef734bf794a42cff0c4
-
SSDEEP
24576:z9Yvwup4OvwkeCbff43B4uE61VM0V+oOtq+G8ZYXDBm75/6s7aa:z9YVp4SvN4KubVZOt9G82Xc7p
Malware Config
Extracted
Protocol: smtp- Host:
gator3220.hostgator.com - Port:
587 - Username:
[email protected] - Password:
RaF5@@ts7^d?AE_grv4fhZ!!
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5fc2290b834e2afe0c28835224182a678c74ae058f7e578d25e729bbfa1d98a.exe"C:\Users\Admin\AppData\Local\Temp\d5fc2290b834e2afe0c28835224182a678c74ae058f7e578d25e729bbfa1d98a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3924,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
304KB
-
Filesize
632KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
336KB
-
Filesize
10.8MB
-
Filesize
300KB
-
Filesize
8KB
-
Filesize
280KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB