Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:51
Static task
static1
Behavioral task
behavioral1
Sample
e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exe
-
Size
935KB
-
MD5
2c1ac7b320974020342a20260302ca51
-
SHA1
0fbcd2055b6a96a26d8e834bf7960a5be2fee4b9
-
SHA256
e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4
-
SHA512
3b082aaa044838580970f55c3df93d5a5e54100306c37de20034e4bdbed160a7943dc11e7710db49acf720e3639583616d4ab824c80f299995606b49f9c43393
-
SSDEEP
24576:lhojaX5qTbSnL4kwUlZNKfMwgxwUZA01BAypIcSTgFEEoF:7caX5q+Xw8ZNKfMJwyA0XpP2EoF
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exepid process 1728 e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exepid process 1728 e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exe 1728 e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exe 1728 e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exe 1728 e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exe"C:\Users\Admin\AppData\Local\Temp\e3cfaef78731984a9ef1ab04ce7bb777866131bb1b92a4f0b5ef0d47482c29d4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1728