Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 15:32
Static task
static1
Behavioral task
behavioral1
Sample
eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
General
-
Target
eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exe
-
Size
1.3MB
-
MD5
00ea566c8bac0766789bee4ee95167d6
-
SHA1
9d2c4f8a5fefebdb53b1543ae0acda205fdaafc6
-
SHA256
eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113
-
SHA512
cd6dd030605ccf384ebc57a98a13817f67a568440dba0dfede8d03632dc0db36630bf7314243a76203b033e9a1ab278a98407a75aaad31e704f6320593fb98ba
-
SSDEEP
24576:5ZVRmsPJt+vRECi67v1yFN2F2KhZhLVZSAJAcSIZM:1PJt+OCi67v1yFNFKN5ZRx
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exepid process 2032 eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exepid process 2032 eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exe 2032 eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exe 2032 eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exe 2032 eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exe"C:\Users\Admin\AppData\Local\Temp\eeb5d0f4e2969ed070d8a06dba48f43fc32ad5e78be72c1e6b850e470911d113.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2032-54-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB