989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe
Size

3.1MB
MD5

7a16f2f0629a440695945db2a191c6a1
SHA1

067c54721377eeefd199acb37402308bdfe73b3b
SHA256

989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944
SHA512

6b698efd1ce0c5ecce64ab63146fc04d9086f70075fc89482e4141b69c8e31327e28618f0f37bc89eadf5ae7211b282beb9b786c9b61e5008405add527a81e0c
SSDEEP

49152:rvlat1Rsi9Zn31w7LsuPKdDeXid5506WGPmFaRa2M/S6vya7/fmzXt8g:e/ssn3QsaKJ9SasXv72zXt8g

Score

7^/10

credential_access execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
748	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	powershell.exe
748	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 748	4768	989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe	84
PID 4768 wrote to memory of 748	4768	989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe	84

C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe
"C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GvnzLcYDF48LKrqyHjjat9so1OVbUg\sensfiles.zip

Filesize
3.9MB

MD5
ac3cac5987610f9b05fc958f8d5e493a

SHA1
f094459a2da309cd48af8b97b6833efc40188269

SHA256
a94b322fbc4fa468606d2a5d2abe6f1bba0be6d204da6ebcdfd5596ba5eab96a

SHA512
5309bb6de2c5f292e4ec93c8f2400ce9237852cbf95883122d14ebbaf34120a8f912fd5c2833cb9d41a320b7203792e88365f338e672f557a6fe95e0566e40d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ddiidval.23f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\coowoo_default_login_data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\coowoo_default_webdata

Filesize
114KB

MD5
a1eeb9d95adbb08fa316226b55e4f278

SHA1
b36e8529ac3f2907750b4fea7037b147fe1061a6

SHA256
2281f98b872ab5ad2d83a055f3802cbac4839f96584d27ea1fc3060428760ba7

SHA512
f26de5333cf4eaa19deb836db18a4303a8897bf88bf98bb78c6a6800badbaa7ab6aeb6444bbbe0e972a5332670bdbb474565da351f3b912449917be21af0afb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\coowoo_network_cookies

Filesize
20KB

MD5
ab008301cc52c4023a474758c35b69f3

SHA1
a16c0e8aa8ac8139523705d0fd481079555b8b14

SHA256
71d7928a5a6b35cae046e4b8d594a84d5dd986b5d857da3c38d3f0e1ac758fc2

SHA512
2b74300bf0a47fa12004da375f976472ba4473c134cb3018f08ce3a83fdc7a25252eb4b2f1c159891a58c323dd85ee130e1067e300bc7132a6d042019069311b

Download Submit
memory/748-0-0x00007FF8D0303000-0x00007FF8D0305000-memory.dmp

Filesize
8KB

Download
memory/748-1-0x0000016D3C620000-0x0000016D3C642000-memory.dmp

Filesize
136KB

Download
memory/748-11-0x00007FF8D0300000-0x00007FF8D0DC1000-memory.dmp

Filesize
10.8MB

Download
memory/748-12-0x00007FF8D0300000-0x00007FF8D0DC1000-memory.dmp

Filesize
10.8MB

Download
memory/748-16-0x00007FF8D0300000-0x00007FF8D0DC1000-memory.dmp

Filesize
10.8MB

Download