Analysis

  • max time kernel
    147s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 15:33

General

  • Target

    ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe

  • Size

    916KB

  • MD5

    cd80bb33720d72ac3fd763f29b4738a1

  • SHA1

    7e14f13f856d671bb6ba32b2a52389c04b634b3e

  • SHA256

    ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29

  • SHA512

    5cccfbf2bf446a983e3c9141bd806d7a7d3603316ab24362227fc3ddcc420b41cf6df03dc88e516c063430b315715599d1b069a5718adfdbdf4f921c498dd2ea

  • SSDEEP

    24576:NJnav4dbkHXlQTlACio/uyy5150XxiRE/U0:bav48X+TlAfUoteF/j

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe
    "C:\Users\Admin\AppData\Local\Temp\ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Users\Admin\AppData\Local\Temp\setup.exe
      C:\Users\Admin\AppData\Local\Temp\setup.exe relaunch
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:5088

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\setup.exe

    Filesize

    916KB

    MD5

    cd80bb33720d72ac3fd763f29b4738a1

    SHA1

    7e14f13f856d671bb6ba32b2a52389c04b634b3e

    SHA256

    ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29

    SHA512

    5cccfbf2bf446a983e3c9141bd806d7a7d3603316ab24362227fc3ddcc420b41cf6df03dc88e516c063430b315715599d1b069a5718adfdbdf4f921c498dd2ea

  • C:\Users\Admin\AppData\Local\Temp\setup.exe

    Filesize

    916KB

    MD5

    cd80bb33720d72ac3fd763f29b4738a1

    SHA1

    7e14f13f856d671bb6ba32b2a52389c04b634b3e

    SHA256

    ee3cd03b88c8a84f1e65e21efb7a770055507c862adb1791f773bc8d2f4b1b29

    SHA512

    5cccfbf2bf446a983e3c9141bd806d7a7d3603316ab24362227fc3ddcc420b41cf6df03dc88e516c063430b315715599d1b069a5718adfdbdf4f921c498dd2ea

  • memory/4512-132-0x0000000000180000-0x0000000000436000-memory.dmp

    Filesize

    2.7MB

  • memory/4512-136-0x0000000000180000-0x0000000000436000-memory.dmp

    Filesize

    2.7MB

  • memory/5088-133-0x0000000000000000-mapping.dmp

  • memory/5088-137-0x0000000000A40000-0x0000000000CF6000-memory.dmp

    Filesize

    2.7MB

  • memory/5088-138-0x0000000000A40000-0x0000000000CF6000-memory.dmp

    Filesize

    2.7MB

  • memory/5088-139-0x0000000000A40000-0x0000000000CF6000-memory.dmp

    Filesize

    2.7MB