Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 15:41

General

  • Target

    89615f5ece3fc7523cac80708b25a41aab8edb96dd1542a68ad910457a290fc1.exe

  • Size

    895KB

  • MD5

    d638c751b6afd37d4dd87bd94ef9185d

  • SHA1

    9ecd15cb2604515f4a94eef53bb93fa4a7b1b4f9

  • SHA256

    89615f5ece3fc7523cac80708b25a41aab8edb96dd1542a68ad910457a290fc1

  • SHA512

    ffbb1a70b7fed3baab5b1bb0201057b18e9d2fa7dd455bb9b23d58490947e54d0014760e12db9c891dfe160c0e6775116f9d3a81b7b811b485c661ac7c511055

  • SSDEEP

    24576:cMU3jHU/KSmpcM2sU9hHxb/ZueOTCbYGETPMHf4:sjHSKSA6DueOvVT+

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89615f5ece3fc7523cac80708b25a41aab8edb96dd1542a68ad910457a290fc1.exe
    "C:\Users\Admin\AppData\Local\Temp\89615f5ece3fc7523cac80708b25a41aab8edb96dd1542a68ad910457a290fc1.exe"
    1⤵
    • Adds Run key to start application
    • Modifies Internet Explorer settings
    PID:1028

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1028-132-0x0000000000BF0000-0x0000000000E2E000-memory.dmp

    Filesize

    2.2MB

  • memory/1028-133-0x0000000000BF0000-0x0000000000E2E000-memory.dmp

    Filesize

    2.2MB