Analysis
-
max time kernel
46s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:37
Static task
static1
Behavioral task
behavioral1
Sample
4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exe
-
Size
937KB
-
MD5
cb83abcbcd28148f7d9eddfa1abbc35e
-
SHA1
a5e94df7d663c96a7f6a626b351d9ebefb57ad1b
-
SHA256
4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744
-
SHA512
70c6dd8bc270ed3de467c446844aaac0fe1631b2662c6a0a2992294aab870541cab1654bfd22e3842e62e7fdac9ea837a8fa2bb30536efda6de015624a71e02a
-
SSDEEP
24576:eLii0FS812mMs549d0ij+BgFoFoGQI9mWuYAHsbYcSEK:e30E812Dh9d0tBgFoFoI0Wesb
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exepid process 1760 4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exepid process 1760 4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exe 1760 4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exe 1760 4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exe 1760 4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exe"C:\Users\Admin\AppData\Local\Temp\4ee22533b65ad560fae5270d6089f023f02d8a7335b7f9d668daea79be025744.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1760