Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 07:28
Static task
static1
Behavioral task
behavioral1
Sample
6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe
-
Size
939KB
-
MD5
c2fe2bfa6f316042bf19ee35127f4680
-
SHA1
bb09ddb5c8f90432db27ee46b027f2c739e68d3b
-
SHA256
6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca
-
SHA512
f62aa6a9d9c779523b70e112c45c6c89ed739d5b647ea36f6318a7d76b0523ed9d7b9a41d9a2e6486f74b37857c3941b198a6f9a9672cd7567a54d4da65e273e
-
SSDEEP
24576:zNmnxb7Fj5ddfE3D1UhbDJoBi6PVFCsVB1la/AhNRcSfTvac:0nNd5ddfET1MvJgi6PVFhBracNFac
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exepid process 4836 6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe 4836 6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exepid process 4836 6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe 4836 6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe 4836 6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe 4836 6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe"C:\Users\Admin\AppData\Local\Temp\6151a9135120817023423d3889f710e81e7e5e613a3568800c187854df5bd2ca.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx