Analysis
-
max time kernel
151s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 22:41
Static task
static1
Behavioral task
behavioral1
Sample
8907794e319f38f3e9dcd20e7b0daa9f6c3941aa173b33bf2684d8abc05ce2f2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8907794e319f38f3e9dcd20e7b0daa9f6c3941aa173b33bf2684d8abc05ce2f2.exe
Resource
win10v2004-20220812-en
General
-
Target
8907794e319f38f3e9dcd20e7b0daa9f6c3941aa173b33bf2684d8abc05ce2f2.exe
-
Size
800KB
-
MD5
bda06d1353a511c44e716cf0c3ee57ce
-
SHA1
80b3e0ae7a7bb9e0b6fe06a2c6cbbf5a0262fea7
-
SHA256
8907794e319f38f3e9dcd20e7b0daa9f6c3941aa173b33bf2684d8abc05ce2f2
-
SHA512
684ad1275c71f5ed88cae9cada6dc42befb500b7b18c375f6f69ac3267c959ef1540c5af47d2cf341c33d833ed5193fa3b06fce306ea8d831a8a3af6c67ba5c0
-
SSDEEP
24576:C0p83JYUBN/HMT3TDWr8CV/nQSTbe6vv/UBVb2pFzr:C0p83V9MT3TDQ8SRT66X/Eb2p
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/816-54-0x0000000000400000-0x0000000000628000-memory.dmp upx behavioral1/memory/816-55-0x0000000000400000-0x0000000000628000-memory.dmp upx behavioral1/memory/816-58-0x0000000000400000-0x0000000000628000-memory.dmp upx behavioral1/memory/816-57-0x0000000000400000-0x0000000000628000-memory.dmp upx behavioral1/memory/816-59-0x0000000000400000-0x0000000000628000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8907794e319f38f3e9dcd20e7b0daa9f6c3941aa173b33bf2684d8abc05ce2f2.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 8907794e319f38f3e9dcd20e7b0daa9f6c3941aa173b33bf2684d8abc05ce2f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SonyAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8907794e319f38f3e9dcd20e7b0daa9f6c3941aa173b33bf2684d8abc05ce2f2.exe" 8907794e319f38f3e9dcd20e7b0daa9f6c3941aa173b33bf2684d8abc05ce2f2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-54-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/816-55-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/816-56-0x0000000076711000-0x0000000076713000-memory.dmpFilesize
8KB
-
memory/816-58-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/816-57-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/816-59-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB