Analysis
-
max time kernel
29s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 16:54
Static task
static1
Behavioral task
behavioral1
Sample
6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe
Resource
win10v2004-20221111-en
General
-
Target
6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe
-
Size
1.3MB
-
MD5
8366309d158f1c688b53088c3cf5aa40
-
SHA1
678a5db0affb7bdfae1d03de380b7f745dacf833
-
SHA256
6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5
-
SHA512
8aac31eef04adedcbf4322b63f9634d544cbbe4e16b3d42fbeb556fa1e38e4a6b0725a6cf66152be83cb1fb93c701339c37827d0652a07acceade9f9872d0263
-
SSDEEP
24576:nBT7a45fdhGL836ISF8zyi5lhZL6HbOOBB2U5gTpZSAaucSEAMb:VPOL83w8Oi5lhZL6iOH58ZC+M
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exepid process 1328 6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exepid process 1328 6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe 1328 6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe 1328 6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe 1328 6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe"C:\Users\Admin\AppData\Local\Temp\6e99f955d2d6acc21adf1f8abb7571fb2e58eebbf02d780905c2fdf86c0255f5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1328