Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
31-08-2021 08:22
Static task
static1
Behavioral task
behavioral1
Sample
e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe
-
Size
504KB
-
MD5
e9454a2ff16897e177d8a11083850ec7
-
SHA1
6b6855931e69d27f5f2e2d828fbeb4db91688996
-
SHA256
e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead
-
SHA512
9bd01ed32887cecefe3987991f3ae3a0375c1cb1bff8b49f795b000076c26a1bb938476e4383b60a3f1ac5de79f7cd3cf2520ef695908815c0fee55a17dcb021
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reportabuse-default_18.svg.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_empty_state.svg.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons.png.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.ini.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\PSReadline.psd1.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hu-hu\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Close.png.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons2x.png.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files\Java\jre1.8.0_66\lib\cmm\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README.txt.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pl.pak.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\te.pak.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main-selector.css.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\ReadUninstall.temp.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files\Windows NT\TableTextService\en-US\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\DarkTheme.acrotheme.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\ui-strings.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\external_extensions.json.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.bat.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\eula.ini.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.jpg.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.exe