Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 04:24
Behavioral task
behavioral1
Sample
c5cf8259812fa98f5879d176fb6cc0079481290fe3cd6a389925847e54336e76.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c5cf8259812fa98f5879d176fb6cc0079481290fe3cd6a389925847e54336e76.exe
Resource
win10v2004-20220414-en
General
-
Target
c5cf8259812fa98f5879d176fb6cc0079481290fe3cd6a389925847e54336e76.exe
-
Size
559KB
-
MD5
8664a770ca28eb9803452cd87b53eb3c
-
SHA1
884e729e7b1c1a07c2a1c0403be483f5a4cd957e
-
SHA256
c5cf8259812fa98f5879d176fb6cc0079481290fe3cd6a389925847e54336e76
-
SHA512
32741a6abccebb750d2326116fd02d33f28cfa7d7a7435a3ba56908bb4365214f8d53196607109da6eb0bef7fd497e5aaba951f4c917ceacd195bd2b8a77f61e
Malware Config
Signatures
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1272-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB