Analysis
-
max time kernel
151s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:36
Static task
static1
Behavioral task
behavioral1
Sample
5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe
-
Size
937KB
-
MD5
6afe7624e48d0ee273d0c8883482aab9
-
SHA1
b1aa00ee28dc28b348d3071a856e0132da8a13b1
-
SHA256
5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006
-
SHA512
5793d53148c201d2a358e35b245162b4eac2cacbad2a249a92b59e6e776f957f5e1dbf0bb35b766c4d921f8c0bf50d2c2d13d4961ba67b7c3fc7966ccf941650
-
SSDEEP
24576:eLii0FS812mMs549d0ij+BgFoFoGQI9mWuYAHsbYcStK:e30E812Dh9d0tBgFoFoI0Wesb
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exepid process 1416 5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe 1416 5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exepid process 1416 5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe 1416 5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe 1416 5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe 1416 5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe"C:\Users\Admin\AppData\Local\Temp\5b4a73feedec9980625b4ac6fe43f923699d0853b491319406ca23f382182006.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx