Analysis
-
max time kernel
41s -
max time network
80s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:01
Static task
static1
Behavioral task
behavioral1
Sample
d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exe
-
Size
935KB
-
MD5
12ffc83d56ca5e3be8b685b0f4b5c428
-
SHA1
58607bd897a1b72d723214067576f74dabf99a76
-
SHA256
d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2
-
SHA512
58d3572cddca4a55b0e54e7e0272e5c136c2e74c222622e1229de0deaa27bee663e4635850cfd06c0bdb3bfe1c1c89222acb04476404ed19e857970d07404763
-
SSDEEP
24576:/M+EMWLrKaCHTza41B3oUD/w9jMrOffAr0GcSRzpt:ENLrKn24v3oUD/sM2O0+j
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exepid process 1960 d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exepid process 1960 d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exe 1960 d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exe 1960 d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exe 1960 d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exe"C:\Users\Admin\AppData\Local\Temp\d321f22a6db872bb8c01d07bbae497b5e68f586afb43ced30566c6241f1126b2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1960-54-0x0000000076321000-0x0000000076323000-memory.dmpFilesize
8KB