Analysis
- max time kernel
93s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
08/11/2024, 02:11
General
- Target 1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98.exe
- Size 1.0MB
- Sample241108-cma4fsshmf
- SHA256 1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98.exe"C:\Users\Admin\AppData\Local\Temp\1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Passwords_Edge.txt
ClearSelect.doc
JoinDebug.doc
memory/5076-0-0x00007FFE43933000-0x00007FFE43935000-memory.dmp
memory/5076-1-0x000001D28D240000-0x000001D28D34A000-memory.dmp
memory/5076-2-0x000001D2A7940000-0x000001D2A79B6000-memory.dmp
memory/5076-3-0x00007FFE43930000-0x00007FFE443F1000-memory.dmp
memory/5076-83-0x00007FFE43930000-0x00007FFE443F1000-memory.dmp