Analysis
-
max time kernel
179s -
max time network
191s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
31-01-2022 06:39
Static task
static1
Behavioral task
behavioral1
Sample
0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe
-
Size
499KB
-
MD5
339165f63aec8d7fd7798129d0fc68ad
-
SHA1
07f594333ca9db110bbee37a9643988f4cc22933
-
SHA256
0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50
-
SHA512
5ef9dbe0f29397adf00f0c4ace8f90fd0aba9a0c2016cecff02f68bcef5781bc5dcd32c18d9b54cc8025581ec6494990dd472cdd36c394637799907e5cc55e3b
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\System\Ole DB\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jvmti.h.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\DESIGNER\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\System\ja-JP\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\CompareComplete.tif.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\es-419.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lv.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoCanary.png.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogoDev.png.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_pt_BR.properties.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.exe.sig.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\LICENSE.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer.bat.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyrun.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\System\msadc\es-ES\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\localedata.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.bat.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\uk.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\System\msadc\de-DE\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Google\Chrome\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\dnsns.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\System\ado\en-US\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\Readme.README 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ms.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\te.pak.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_CN.jar.pysa 0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50.exe