Analysis
-
max time kernel
40s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22/11/2022, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83.exe
Resource
win7-20220812-en
3 signatures
150 seconds
General
-
Target
baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83.exe
-
Size
937KB
-
MD5
00ee85d216a8c5633d3db6979746be6d
-
SHA1
7adb71cd6576c6ad4f960e032d6cf39aa7cc27b3
-
SHA256
baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83
-
SHA512
b34953ae6b19628c6aa0cf983d88d68f9b414f500cefd126d534900d66f539352a3f9b829a3be495d3b2e5b4e37e7db74263ae807e5dc6a8e6e53b41db23d429
-
SSDEEP
24576:S/6NgZyGGZAim8giQ3UA/0TIRKb0gJAvaAtmSJcSUJEh:ybZfGZARViQkA/0TIR3gGvtxNh
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1504 baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1504 baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83.exe 1504 baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83.exe 1504 baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83.exe 1504 baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83.exe"C:\Users\Admin\AppData\Local\Temp\baf6521af25591f7b24abb2267a303271f843f4a76c4f11392c0141b02482a83.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1504