Analysis

  • max time kernel
    150s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 22:59

General

  • Target

    83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exe

  • Size

    800KB

  • MD5

    f7442c2047ee63a8de8b6b8e6a7e53f4

  • SHA1

    1e6bb44d34a16664c7b802240274666908ab139f

  • SHA256

    83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24

  • SHA512

    5e4068d35f07032f028d631f8b139ae8e1c67dc3d071d7b6300d2588d373e91dbb512984375e7731ec2de7999f70bc563533e32ca8061ed017ef57678482b16b

  • SSDEEP

    24576:wFujM7Ze81/KzFsgHXYZXej6HjD8ub0+x5VbUiD5pt5T:wFug7ZeJeghjqH8yBx5NUiDl5

Malware Config

Signatures

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exe
    "C:\Users\Admin\AppData\Local\Temp\83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exe"
    1⤵
    • Adds Run key to start application
    PID:1564

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1564-54-0x0000000000400000-0x0000000000636000-memory.dmp

    Filesize

    2.2MB

  • memory/1564-55-0x0000000000400000-0x0000000000636000-memory.dmp

    Filesize

    2.2MB

  • memory/1564-56-0x0000000000400000-0x0000000000636000-memory.dmp

    Filesize

    2.2MB

  • memory/1564-57-0x0000000075681000-0x0000000075683000-memory.dmp

    Filesize

    8KB

  • memory/1564-58-0x0000000000400000-0x0000000000636000-memory.dmp

    Filesize

    2.2MB

  • memory/1564-59-0x0000000000400000-0x0000000000636000-memory.dmp

    Filesize

    2.2MB

  • memory/1564-60-0x0000000000400000-0x0000000000636000-memory.dmp

    Filesize

    2.2MB