Analysis

  • max time kernel
    38s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 16:55

General

  • Target

    6d75d9ce172832bbac10e5502f0e24b6011b74aa4c732485ecac8b7202d22bb3.exe

  • Size

    1.3MB

  • MD5

    81b754147155c4992e8b8f98091ee17b

  • SHA1

    d14482769dc7915605176e05f703a7a75cf4a387

  • SHA256

    6d75d9ce172832bbac10e5502f0e24b6011b74aa4c732485ecac8b7202d22bb3

  • SHA512

    6eeb9b430c72ddafef2c54697ca29a9ed5224e8e94de9a45d998704ccecf093ca6543deec63f245df41fb18edd4861c17efd8a6e9dd74c5c651a42ae809cca13

  • SSDEEP

    24576:j2ZwH11rpoIazQ/QM0MXjbl/rD2Z8g3DZRAfuvcS3+C:hH11rEzQ/QM0MX1HcPTZmuKC

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d75d9ce172832bbac10e5502f0e24b6011b74aa4c732485ecac8b7202d22bb3.exe
    "C:\Users\Admin\AppData\Local\Temp\6d75d9ce172832bbac10e5502f0e24b6011b74aa4c732485ecac8b7202d22bb3.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:828

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/828-54-0x0000000075A11000-0x0000000075A13000-memory.dmp
    Filesize

    8KB