Analysis
- max time kernel
1202s - max time network
1197s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/10/2021, 16:28
Static task
static1
Behavioral task
behavioral1
Sample
eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
- Size 1.2MB
- Sample211012-ty57eacgd8
- SHA256 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801
- MD5 6e667db54814bbf9cde7c00a1f9ccaad
- SHA1 a2feadc2e292c60436f63cdc17a7a61ed78b9859
- SHA512 c77f5395a188feae436ac88d675d215d220bbd0fdd659522d99140c5add8edfa17f8447ce8f56f17ff22f51a2aac21ca393c01b8c46093c1c5080f9f4f3427ba
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73 PID 516 wrote to memory of 1980 516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe"C:\Users\Admin\AppData\Local\Temp\eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵PID:1980
-