Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 15:46
Static task
static1
Behavioral task
behavioral1
Sample
d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exe
-
Size
1.3MB
-
MD5
337fbd9c462bff3a05fb4a10c1dc5e10
-
SHA1
eea436828ded5b23cea31e0bb0bd18142c02155d
-
SHA256
d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe
-
SHA512
9f76efbfc6661574a98ddcd5aacd8c7f1b9ca08d31b15e0fb08dadd69d26f98e2b341619f7dc37a79158a430079a944cc5e6138bbdc8ba0588c3c9a92b6496ca
-
SSDEEP
24576:vCbV1tebpntzapYXTul7JOaNBbArSv8e0ZtAEZcSfqNT:sEbpnKoTul7JOaNOrve0Z1ENT
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exepid process 1976 d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exepid process 1976 d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exe 1976 d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exe 1976 d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exe 1976 d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exe"C:\Users\Admin\AppData\Local\Temp\d8c9ef19fb2c1225433571d10b56542b41cbad23e3c50c984d840456e4d700fe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1976