Analysis
- max time kernel
92s - max time network
142s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250217-en - resource tags
- submitted
11/03/2025, 16:14
General
- Target coderoom-main/jtijhkasdjrhg.exe
- Size 538KB
- Sample250311-tp2gvsxpv2
- SHA256 077364482914188a642ea8de919005104d1609840ac543f6479bf63fc3c54d67
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\coderoom-main\jtijhkasdjrhg.exe"C:\Users\Admin\AppData\Local\Temp\coderoom-main\jtijhkasdjrhg.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4348-0-0x00007FFD79E13000-0x00007FFD79E15000-memory.dmp
memory/4348-1-0x0000000000AE0000-0x0000000000B6C000-memory.dmp
memory/4348-2-0x00007FFD79E10000-0x00007FFD7A8D2000-memory.dmp
memory/4348-3-0x000000001E9E0000-0x000000001EAEA000-memory.dmp
memory/4348-4-0x000000001BAA0000-0x000000001BAB2000-memory.dmp
memory/4348-5-0x000000001D1E0000-0x000000001D21C000-memory.dmp
memory/4348-6-0x000000001EE70000-0x000000001EEE6000-memory.dmp
memory/4348-7-0x000000001D220000-0x000000001D23E000-memory.dmp
memory/4348-8-0x00007FFD79E10000-0x00007FFD7A8D2000-memory.dmp
memory/4348-10-0x00000000200B0000-0x00000000205D8000-memory.dmp
memory/4348-9-0x000000001F5C0000-0x000000001F782000-memory.dmp
memory/4348-11-0x00007FFD79E10000-0x00007FFD7A8D2000-memory.dmp
memory/4348-12-0x00007FFD79E13000-0x00007FFD79E15000-memory.dmp
memory/4348-13-0x00007FFD79E10000-0x00007FFD7A8D2000-memory.dmp
memory/4348-15-0x00007FFD79E10000-0x00007FFD7A8D2000-memory.dmp