Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 16:58
Static task
static1
Behavioral task
behavioral1
Sample
68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe
Resource
win10v2004-20221111-en
General
-
Target
68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe
-
Size
1.3MB
-
MD5
933439d6be6e54c77ec9c9803b9bba72
-
SHA1
8c1c7cd1fd2a69034ece308ffde4e09e9c68987b
-
SHA256
68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6
-
SHA512
a1a1c851ebd8d28d54669853325ff4e7d60f98e3013333a8135afe951434d894bba77e405cd6567234a7f172c9fb8d0a8bfb97ea8649a0814f30a4cf94b82b77
-
SSDEEP
24576:5ZVRmsPJt+vRECi67v1yFN2F2KhZhLVZSAJAcS6ZM:1PJt+OCi67v1yFNFKN5ZRP
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exepid process 1716 68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exepid process 1716 68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe 1716 68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe 1716 68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe 1716 68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe"C:\Users\Admin\AppData\Local\Temp\68b384c0bceabd34674e523f7766392becd53f22c414dcc476e2594a580846b6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1716