Analysis
-
max time kernel
49s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 15:32
Static task
static1
Behavioral task
behavioral1
Sample
ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exe
-
Size
1.3MB
-
MD5
d26ebd141b214d97ad245e79e579b3c9
-
SHA1
700b0cb44de57eb46d4d4479f366d8f9d4f08e33
-
SHA256
ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6
-
SHA512
91a40c917312c66f875b991a138fe5b406a631a75a533a579886e0053e525d87ca4a2383ce26b96c52621091dbca8974739a0961e6ff908e70de8f575fa4e554
-
SSDEEP
24576:vCbV1tebpntzapYXTul7JOaNBbArSv8e0ZtAEZcS3qNT:sEbpnKoTul7JOaNOrve0Z18NT
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exepid process 1776 ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exepid process 1776 ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exe 1776 ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exe 1776 ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exe 1776 ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exe"C:\Users\Admin\AppData\Local\Temp\ef61c738272aceda380695333d6ec23a529edd69051d4ea1f7cc0e6bb2c2f6d6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1776