Analysis
-
max time kernel
111s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 04:08
Static task
static1
Behavioral task
behavioral1
Sample
8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe
-
Size
854KB
-
MD5
524b89e678434bdbbf0121a26c6da57e
-
SHA1
7a6dbd3db836450d56d6882bf9daeb8fd6d8c2e5
-
SHA256
8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38
-
SHA512
5f47d2ba25fb3aa01c1bbe2650b7b2845f5d8b815cc0313847a14affa48203b7dc90c42633ee988f1107ff2bc5cded863f29d6a87b055d9dbca559bfac9fd1cd
-
SSDEEP
24576:/X/eO4qIXaVWt1ZASAEvVvYd06u+76SIJpXqv:+O4UWFW3AJpXqv
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4380 8952185d781e7bb64eb76acdf500398d704b18605136e4d901e04342e00c4c38.exe