Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 07:52
Static task
static1
Behavioral task
behavioral1
Sample
aba2743d1110f0548b81ec76b2df6f97fb711a554428cf411366fc92efe26a96.exe
Resource
win7-20220901-en
3 signatures
150 seconds
General
-
Target
aba2743d1110f0548b81ec76b2df6f97fb711a554428cf411366fc92efe26a96.exe
-
Size
630KB
-
MD5
318ec35363193c33ed17bd33e5db2e69
-
SHA1
0324135ee0c1f1ae30fe4a9b2ac75346d606c172
-
SHA256
aba2743d1110f0548b81ec76b2df6f97fb711a554428cf411366fc92efe26a96
-
SHA512
8e057cc1b29c28c84ff9e9c5e9ddfa1de2c9d077d990abf4d2d575363237a2ea0d8141ff48fbd6e6c96f87290f354d86e0f21f8c58d49a27e6d5cf66709b36ea
-
SSDEEP
12288:o6C0w9s0Dj3LF0JNjnmz0w8ajtzBwOhIzcJUE+Jpf+xzSX:ox0w9s0DTLF0PKz0ruBNGoJUJyzSX
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1768 aba2743d1110f0548b81ec76b2df6f97fb711a554428cf411366fc92efe26a96.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1768 aba2743d1110f0548b81ec76b2df6f97fb711a554428cf411366fc92efe26a96.exe 1768 aba2743d1110f0548b81ec76b2df6f97fb711a554428cf411366fc92efe26a96.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aba2743d1110f0548b81ec76b2df6f97fb711a554428cf411366fc92efe26a96.exe"C:\Users\Admin\AppData\Local\Temp\aba2743d1110f0548b81ec76b2df6f97fb711a554428cf411366fc92efe26a96.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1768