Analysis
-
max time kernel
18s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:45
Static task
static1
Behavioral task
behavioral1
Sample
5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exe
-
Size
935KB
-
MD5
2d51b8c148fd058f6ee300169fc68cc0
-
SHA1
a2f7e4123ac7327e90ffe2519f27008fa935dafb
-
SHA256
5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493
-
SHA512
51b10d2d7e49ef7c11bd0fea5133e1817df3778d5f3cadeb2ac8cdf01091901e3d9a4c7c814f6f51ee33cf96c85dfb218424b9a68d2ffc56f7e96b2b068d6c37
-
SSDEEP
24576:9hKrgaIj+7bsYATkNU06QIFjzK5LJcpIF5ukriA0//cSxw:MoYATkXxIlzK5LJb5VrM/6
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exepid process 1544 5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exepid process 1544 5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exe 1544 5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exe 1544 5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exe 1544 5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exe"C:\Users\Admin\AppData\Local\Temp\5f41221551df9e941f1eb9de525e0ae595e675ffbde39a1eccf94aa2c913e493.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1544