3ac41aaeb5772f77fa5e3c6bfaeecc906430b37abb0b7d3be40adc87b0d57e1d

Analysis

max time kernel
150s
max time network
138s
platform
windows10_x64
resource
win10v200722
submitted
30/07/2020, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER_GB48394.exe
Size 1.7MB
Sample200730-k493flef5a
SHA256 3ac41aaeb5772f77fa5e3c6bfaeecc906430b37abb0b7d3be40adc87b0d57e1d
MD5 1021003d26578c68f1e191061055d660
SHA1 f9257234cdd4824de4f2421dfd0b4b56174f2660
SHA512 7723f9d8cce8de56c8a24f8fc7371ea4fd1f1cf150638bd3f0b1d1bc3fc86f591d506aaa84fbbd34ff795d18f981b46fc3706e7afb02921c52d86fc24c0d94ba
MD5 SHA1 SHA512

Score

7^/10

spyware

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3712	ORDER_GB48394.exe

Loads dropped DLL 6 IoCs

pid	Process
3712	ORDER_GB48394.exe
3712	ORDER_GB48394.exe
3712	ORDER_GB48394.exe
3712	ORDER_GB48394.exe
3712	ORDER_GB48394.exe
3712	ORDER_GB48394.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad47-4.dat	js

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\ORDER_GB48394.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_GB48394.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
PID:3712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3712-0-0x0000000003150000-0x00000000032A4000-memory.dmp

Download