Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 08:09
Static task
static1
Behavioral task
behavioral1
Sample
c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exe
-
Size
944KB
-
MD5
e3cf422a578f4d7022f99c6db4d7b6cf
-
SHA1
2ffa111281bd19906d22f804143efdcef034b2d6
-
SHA256
c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d
-
SHA512
95f35766bf2f6f370d79e01aba3449e97a355cc6485743163e101076d4f859ebcd5c8756ce3b8dc5c36f80fdf593001e5acb8afab379a10660381e8b160d6287
-
SSDEEP
24576:iDJzRF4RDl2X4MSiZjMDduMYql7cuHGEZKAk+kSFryFQlP:MJv4RlS5ZjMDduMFzmEZU+bl
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exepid process 1412 c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exepid process 1412 c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exe 1412 c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exe 1412 c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exe 1412 c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exe"C:\Users\Admin\AppData\Local\Temp\c103013edbe62dac50e99d95841e0627d913f55b0d3e7fd4101ee851b300848d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1412