Analysis
-
max time kernel
158s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:41
Behavioral task
behavioral1
Sample
72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe
Resource
win10v2004-20220812-en
General
-
Target
72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe
-
Size
895KB
-
MD5
e8e30246f72fc8d42e162fa4a8395e3b
-
SHA1
12f6776ba341cefa1a840b0478ff40b56aa5f20c
-
SHA256
72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07
-
SHA512
5d8b26fe9a660358e5502936a5bec671792601e596dafaebf5eed07d1fa51ba31fee57ce05529194479ec8bd16ea10b822b9089a5379acfe45c15c57d867e43d
-
SSDEEP
24576:yS/EKKA1XZCMp5nPPkLuQhHxGTqkEt6Rpu2mGPQ5rBvbMInbm1:yIEKKAHR5PMLu0g7RppgrxVb
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3348-132-0x00000000002C0000-0x00000000004FE000-memory.dmp upx behavioral2/memory/3348-133-0x00000000002C0000-0x00000000004FE000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe" 72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main 72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DefaultCompressedRecord = d980f97f73d95237962a74b78b555be33df0bfe946ddfd948201428bf930c1a5516d9f19398e5e33c0d90f99532835fd515214a4f850197fe5f015a0e46e1c690decd8eabdabcb958ff327bfbbffc89b7409d96173677fe7833b311166a3f1e5d9ac038e99d2d9 72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RecordModifiedMax = "DEkAEkVQhV1Q9n1eiLiu0Fd7+gBGZG/KDT559pJhuGUPj8hjDCSIvEZBFbAmYvEHoQ==" 72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FlagsModifiedValid = 0000000000000000 72fe3a7677f7baf3814b506c74d8b152009216ae5f68e3bf3d3cf1ed87b8bd07.exe