Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 22:59
Static task
static1
Behavioral task
behavioral1
Sample
83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exe
Resource
win10v2004-20220812-en
General
-
Target
83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exe
-
Size
800KB
-
MD5
f7442c2047ee63a8de8b6b8e6a7e53f4
-
SHA1
1e6bb44d34a16664c7b802240274666908ab139f
-
SHA256
83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24
-
SHA512
5e4068d35f07032f028d631f8b139ae8e1c67dc3d071d7b6300d2588d373e91dbb512984375e7731ec2de7999f70bc563533e32ca8061ed017ef57678482b16b
-
SSDEEP
24576:wFujM7Ze81/KzFsgHXYZXej6HjD8ub0+x5VbUiD5pt5T:wFug7ZeJeghjqH8yBx5NUiDl5
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1564-55-0x0000000000400000-0x0000000000636000-memory.dmp upx behavioral1/memory/1564-56-0x0000000000400000-0x0000000000636000-memory.dmp upx behavioral1/memory/1564-58-0x0000000000400000-0x0000000000636000-memory.dmp upx behavioral1/memory/1564-59-0x0000000000400000-0x0000000000636000-memory.dmp upx behavioral1/memory/1564-60-0x0000000000400000-0x0000000000636000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MediaInformer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exe" 83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 83118ac10cc9d3b41659e7378988abfc5cb9de452f02b6e7fff0d21a4b7d5b24.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.