Analysis
-
max time kernel
19s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-06-2022 16:38
Behavioral task
behavioral1
Sample
12587c1b10db42589b5b5cf8c14198752c6807d0480fac55e024210d0b915285.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
12587c1b10db42589b5b5cf8c14198752c6807d0480fac55e024210d0b915285.exe
Resource
win10v2004-20220414-en
General
-
Target
12587c1b10db42589b5b5cf8c14198752c6807d0480fac55e024210d0b915285.exe
-
Size
555KB
-
MD5
8908e1556eaa543261fbadbea56ad2e9
-
SHA1
8da4f5d3c1059a3f256ac64a4da0909913c9d123
-
SHA256
12587c1b10db42589b5b5cf8c14198752c6807d0480fac55e024210d0b915285
-
SHA512
19dc971087a9ba0c282032d4eaa99f459e0d475a25ec231773c397f544f819f849c860d3bc590d8fe9a06d29dde833c469bcaacbdf32271c9fb2bb2fd761b7f6
Malware Config
Signatures
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1904-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB