Analysis
-
max time kernel
29s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:10
Static task
static1
Behavioral task
behavioral1
Sample
56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exe
-
Size
1.3MB
-
MD5
e282b793ad57fd9e34e6765bcf95cf80
-
SHA1
160538ba992ea723c308cad5c4f49cef0923325b
-
SHA256
56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f
-
SHA512
c338f7e928f72134f1e09472a0c75724633002690ce9630cc87b3dd2a3062b1593fa16bd8a0958bbcdc7f6ec3304bfd7c8c03012c36e7d9609664ce01cedd16a
-
SSDEEP
24576:69jCsq8srPKK1BUtfEit79HIaOxabqA4ZTAbFcSN:nN8srPKEUtfEit79HINaN4Z4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exepid process 1236 56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exepid process 1236 56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exe 1236 56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exe 1236 56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exe 1236 56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exe"C:\Users\Admin\AppData\Local\Temp\56a017ff60d440f0a59f9d2add2e37b47252fd03a66d3b5ff480006100ddc66f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1236