Analysis
-
max time kernel
38s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 17:46
Behavioral task
behavioral1
Sample
8f98297f190db64c6c1bb9b85b78eca5.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
8f98297f190db64c6c1bb9b85b78eca5.exe
Resource
win10v2004-20220722-en
General
-
Target
8f98297f190db64c6c1bb9b85b78eca5.exe
-
Size
273KB
-
MD5
8f98297f190db64c6c1bb9b85b78eca5
-
SHA1
1bef5e61a3c11a8651870f3ad386f0a09f94de52
-
SHA256
3adeefdaffda88ac8183d5c4164c9ad10b63c039c72fac187a596f4fcf906c00
-
SHA512
193054828f611dc98410472d519618de039cdf33fd9611d7214d695f8328c718a7b444412e8de74ad7ab14ed922f52354dd73b3069acddea1942469062f6721b
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll acprotect \Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll acprotect -
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll upx \Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll upx -
Loads dropped DLL 2 IoCs
Processes:
8f98297f190db64c6c1bb9b85b78eca5.exepid process 1656 8f98297f190db64c6c1bb9b85b78eca5.exe 1656 8f98297f190db64c6c1bb9b85b78eca5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dllFilesize
171KB
MD51023df7abd2d9b7f0bdc77024c978f0b
SHA186f779a7bb2878bb0cc24cece2130bc451124a1d
SHA256d7067d18aff17bbd5013a708f02e5d87beb20af19f2381986952a119ce5cf420
SHA5121da1ca20319f9da92f1a1f0a2e590dcd1a87b8a2dd340b36ce680626ba68937a5f3c5f807afe29cb01e0000772044b892ed4cd1cf82337666fea7efc1955ecf7
-
\Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dllFilesize
171KB
MD51023df7abd2d9b7f0bdc77024c978f0b
SHA186f779a7bb2878bb0cc24cece2130bc451124a1d
SHA256d7067d18aff17bbd5013a708f02e5d87beb20af19f2381986952a119ce5cf420
SHA5121da1ca20319f9da92f1a1f0a2e590dcd1a87b8a2dd340b36ce680626ba68937a5f3c5f807afe29cb01e0000772044b892ed4cd1cf82337666fea7efc1955ecf7
-
memory/1656-54-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/1656-56-0x0000000010000000-0x000000001005A000-memory.dmpFilesize
360KB
-
memory/1656-58-0x0000000010000000-0x000000001005A000-memory.dmpFilesize
360KB