Analysis
-
max time kernel
162s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 06:39
Static task
static1
Behavioral task
behavioral1
Sample
0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe
-
Size
499KB
-
MD5
339165f63aec8d7fd7798129d0fc68ad
-
SHA1
07f594333ca9db110bbee37a9643988f4cc22933
-
SHA256
0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50
-
SHA512
5ef9dbe0f29397adf00f0c4ace8f90fd0aba9a0c2016cecff02f68bcef5781bc5dcd32c18d9b54cc8025581ec6494990dd472cdd36c394637799907e5cc55e3b
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\te.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\7z.sfx.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\System\ado\ja-JP\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\el.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pt-BR.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\external_extensions.json.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\System\ado\de-DE\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\DVD Maker\ja-JP\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\youtube.crx.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\da.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\sv.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\vi.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogo.png.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\Services\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\icudtl.dat.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ru.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\ImportPublish.ogg.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ms.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\Logo.png.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe