Analysis
- max time kernel
73s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
24/11/2022, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe
Resource
win7-20220901-en
3 signatures
150 seconds
General
- Target 157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe
- Size 937KB
- Sample221124-h47rmsbc61
- SHA256 157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9
- MD5 88670d6e9b2205116ec3de8072692e21
- SHA1 ef5b6120fc5d3d289f64b5e4824151b1ef7c264c
- SHA512 b1b4b578e460c2ab0ebd1aacea4e5762246c5fb5693ce57b46a6a9aededef23d2249abc45a268ea3db476a464bbb3d3e4ee2db0c5c0d27bbc96f876ca65621b0
- SSDEEP 24576:S/6NgZyGGZAim8giQ3UA/0TIRKb0gJAvaAtmSJcS+JEh:ybZfGZARViQkA/0TIR3gGvtxLh
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1824 157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe 1824 157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1824 157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe 1824 157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe 1824 157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe 1824 157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe"C:\Users\Admin\AppData\Local\Temp\157819bf15862fe5a1538896780f2b94587e35d09b7121d1200e565f5cd1cbc9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1824