Analysis
-
max time kernel
118s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:15
General
-
Target
a2c94b545313da9045688c2829942864.exe
-
Size
490KB
-
MD5
a2c94b545313da9045688c2829942864
-
SHA1
58e891fef526b56e14e9a00410314f29ed2adbf2
-
SHA256
3d0625dd449a820fe8bcc1d9d941ebf7ca64e8ada2f2dda1493e31fad8f9ce67
-
SHA512
11a76466143dcd1b0e075c1ceb43eac72910e423807f2da5e35071e207d2fdec312156ea36aacd6f72865adc4e69de549cc48185282c7c5b7803aeb27c5e7b09
-
SSDEEP
6144:Y/bEd8CMqRmP+lFxOKKIrX4svtTGUrsQsKE9khDf5Wgy0R/E2Sq1eYh8IvA:OevMqwWlDmHQJ5HyaEDq5iIvA
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2c94b545313da9045688c2829942864.exe"C:\Users\Admin\AppData\Local\Temp\a2c94b545313da9045688c2829942864.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
9.9MB