Analysis
-
max time kernel
237s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:21
Static task
static1
Behavioral task
behavioral1
Sample
4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exe
-
Size
937KB
-
MD5
b036d3cadd6eba3e39d4ab0df6e05f66
-
SHA1
ea57e79408ae37a4c3efad513f54263ac51ca1cc
-
SHA256
4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73
-
SHA512
aad03ac72d739104af456f7dd3e09d6a09f85968299b596fe68b08f4c7dafdb02c32bdd6a2c2ea6c90285eeb59c57004e350645751f524505a86e12061e1ba8d
-
SSDEEP
24576:Oj4YKC2ab1h/h9s99JLU8xwRhscqUqAASgCcSVej:tpCTbfh9sNLU8xwRXq78gTj
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exepid process 512 4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exepid process 512 4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exe 512 4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exe 512 4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exe 512 4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exe"C:\Users\Admin\AppData\Local\Temp\4f1e54dcd478921ba62062d7a45bf40b3135875c061c3d6219939bbebec39e73.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:512