Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 13:08

General

  • Target

    5086fe549e186bfddeab3558f77dde9633dc6389adb8cdd9406d38c26fcdc835.exe

  • Size

    810KB

  • MD5

    0c57fedabf48c7b64b18a053dcd60859

  • SHA1

    06856f32398cc15afdd001e371a7619b04153b73

  • SHA256

    5086fe549e186bfddeab3558f77dde9633dc6389adb8cdd9406d38c26fcdc835

  • SHA512

    184ece162825a837acd3bcbd38d4a62a5c6a9609917a311ae99fcf61f4964b8e509ee9c145e4856733a8ca94160cd17e450c0fd1625b811b48aa8cd7dcfb3d66

  • SSDEEP

    12288:iyxWuyYPPZrek9PtuTR2KFKNJ41d7tb+CujHgFEHoYMbeZxhaHczJhYSC4kiB:8uNPYpI3NwZt6FaEHhjZT0OY

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5086fe549e186bfddeab3558f77dde9633dc6389adb8cdd9406d38c26fcdc835.exe
    "C:\Users\Admin\AppData\Local\Temp\5086fe549e186bfddeab3558f77dde9633dc6389adb8cdd9406d38c26fcdc835.exe"
    1⤵
    • Adds Run key to start application
    PID:1048

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1048-54-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB

  • memory/1048-56-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB

  • memory/1048-57-0x00000000759F1000-0x00000000759F3000-memory.dmp

    Filesize

    8KB

  • memory/1048-58-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB

  • memory/1048-59-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB