Analysis
-
max time kernel
41s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c.exe
Resource
win7-20220901-en
3 signatures
150 seconds
General
-
Target
666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c.exe
-
Size
943KB
-
MD5
27c287a2ad1f33beaeaee5dc9a1fbe07
-
SHA1
921f30def0947961483fc0871e360d0020e6b0ef
-
SHA256
666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c
-
SHA512
d1bbb32b981452ff100496dc4c2560e2da90c02b8d7b4ba36a9fb1152df7f8b9ee1933a9d007d5e2fe4feb9c5efcabdd78844174b8cac048cb5822f13e7e6e66
-
SSDEEP
24576:5Y4eMLZr9dgI8MxyLGMnWp/Y+WjlCQQfk2auZKAAqyJSFrnRaxl:ilMLbGIiqMWp/Y+VRrXZEAax
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1492 666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1492 666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c.exe 1492 666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c.exe 1492 666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c.exe 1492 666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c.exe"C:\Users\Admin\AppData\Local\Temp\666ef226b9b5ce46e819b1a404ce1a1e261f07583c2be5c3ad62080ead5ce96c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1492