Analysis
-
max time kernel
139s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-08-2024 09:20
General
-
Target
Identification.exe
-
Size
5.6MB
-
MD5
7916d9dbba2543dfcafd0be76eb3e965
-
SHA1
64d4efa6e1b124d758285f6d8069ce117a5a45dc
-
SHA256
ee532f95590e3b36c2678033213eb18bd9e579c27cbc65e6afe5f23aac6f019c
-
SHA512
d3af74e625fe46df4feace1e47793db53bebbaa0645d34030e98575527df686341e4bda47d660531c33e0ff0dcb1966b0c012c1704da9ed1296d8031cbce7b6c
-
SSDEEP
49152:qyHmza1sJ+5pTE5k6DBFNHpwEmtiS7Z6G5FwR0Lzhzwvi6fScmW73tOhsd41L3vi:qx2Zzci6Zh3asd4pCPaQ
Malware Config
Signatures
-
DeerStealer 15 IoCs
Detects DeerStealer malware - JaffaCakes118.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Identification.exe"C:\Users\Admin\AppData\Local\Temp\Identification.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.0MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.0MB