Analysis
-
max time kernel
152s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:41
Behavioral task
behavioral1
Sample
5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe
Resource
win10v2004-20221111-en
General
-
Target
5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe
-
Size
895KB
-
MD5
6dcce9648849075939d5b9db5f26694e
-
SHA1
328cb4e03907f142ff4592995fb8325f6a9b81bf
-
SHA256
5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f
-
SHA512
6f9c1f40086099705ce26e15910a52d0d235afeeac4c6db964560f5c985dd131597b0b46f755cd2362db79dc985353716c2a465e43e9ee46ffbedd3c5613e91b
-
SSDEEP
24576:WMU3jHU/KSmpcM2sU9hHxb/ZueOTCbYGETPMHfQz3NPJOI:+jHSKSA6DueOvVT+UNPJf
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2152-132-0x0000000000A30000-0x0000000000C6E000-memory.dmp upx behavioral2/memory/2152-133-0x0000000000A30000-0x0000000000C6E000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe" 5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RecordModifiedMax = "DAYYLjymg4amEO1HG5h3eu9dsajmhuhuE5x6X5YRCDhA29EMlRrx8oPgVp9MmIWRtA==" 5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FlagsModifiedValid = 0000000000000000 5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main 5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DefaultCompressedRecord = d980f97f73f52491b6a5dc2ea70a8e82770efdcf8aa01addbcf9ec37f9f7f9bebfadacc4c6d6c697935026c79d0e4ecc457dd613a8d7a34cf4195b7fc2d31d893a00a5d9d8bad658a989aef2d794098486bcb92571677f452c7080b2d4d9e5fac414714725d386 5c6abf537d9a1791a6f2e7509377e2bbefb298219a73f87dd98fe571ccec490f.exe