Analysis

  • max time kernel
    0s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 19:34

General

  • Target

    a6c2a90a390e77076ff0fca78301e2e8ac7adf38ec3b55442af5110424c573e9.exe

  • Size

    532KB

  • MD5

    5b326747c5de6d0b684c576cd7a9ebd2

  • SHA1

    b0e22988ec66ed6337e407d264ebf48264fa0a22

  • SHA256

    a6c2a90a390e77076ff0fca78301e2e8ac7adf38ec3b55442af5110424c573e9

  • SHA512

    67ee810ba34c860a7f68399b2c4ca1916004e983108e51ea43b8dc6272e0facf2b627a293493f57b489aecbaf8e253bc8824fc18d172275955feff2bc32d438f

  • SSDEEP

    12288:fCiN9vp/FpHRdjWouP02XXV8Q0x9NkGBjOftD0gQWGMtV:fC2/dBjWo8iQ0DzBKtD02D

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6c2a90a390e77076ff0fca78301e2e8ac7adf38ec3b55442af5110424c573e9.exe
    "C:\Users\Admin\AppData\Local\Temp\a6c2a90a390e77076ff0fca78301e2e8ac7adf38ec3b55442af5110424c573e9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\44\Process.txt

    Filesize

    438B

    MD5

    e4c5a9c9a68d0c3f9fa878cd64bee407

    SHA1

    7af1ef39e9a536a4a49bb9add42a665bacaf4d30

    SHA256

    4c04742124dd87fcfa6af03c3062f677806c6ec0fe8e169774d76bd83bd4ce4b

    SHA512

    c401f4736dffd397a45b71f7fa2b0a879b10309b594f53bcda485afc3660600fccd34744580a61fc74271ad4523281bd325cbd0bd383839b33b7d0f648e0cc51

  • memory/2224-0-0x000007FEF52A3000-0x000007FEF52A4000-memory.dmp

    Filesize

    4KB

  • memory/2224-1-0x0000000001150000-0x00000000011DC000-memory.dmp

    Filesize

    560KB

  • memory/2224-2-0x000000001AE90000-0x000000001AF6A000-memory.dmp

    Filesize

    872KB

  • memory/2224-3-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB

  • memory/2224-4-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

    Filesize

    9.9MB

  • memory/2224-56-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

    Filesize

    9.9MB