Analysis
-
max time kernel
94s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 09:37
General
-
Target
fw3.exe
-
Size
338KB
-
MD5
720472cdad6f6ea6a57ea95824143ea0
-
SHA1
f95a09690c3908581ca147687ceef19bdfb3f64a
-
SHA256
245c35840df28cc2bd9bf3ccbc18392f56176780b463b0619ebd918d5be744c5
-
SHA512
e3e433e8ffd2639e1bde04e2bb4a4fb7ff7fda53253769fec298472036cfdf30ba8df9859145aa457b6306d1a4eb1428266020797ac0f4937851918b629b5fe6
-
SSDEEP
6144:J++596s5w8sdJnGFZ/tQPHpc2L5Dcach4mbYRtoa/a7BDxdXsZSK4iqBB+X5:pb5dsdJnGtQPu4k18ROamnXsZZz5
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fw3.exe"C:\Users\Admin\AppData\Local\Temp\fw3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB