Analysis
-
max time kernel
248s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exe
-
Size
961KB
-
MD5
62c0b3592a24894e211d2c067aaca1ee
-
SHA1
ac7d5baa109b324b79a6c36a19ce6da089a6b690
-
SHA256
61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df
-
SHA512
dfaf7aebfd22ff8d8d3212ed76c4424910e7f44bde638aac4113bd2f3a3a28d0baadac22643de9c16d98a8249d8b80dcbbbbdf388f183a3433df93cf387f353b
-
SSDEEP
24576:ikQ1aOCco82PkHsddUplpYE+JglzGWqVgjsaxZiAvS5cSgS:r/co82CsrUplpYEZ1BjsEZyp
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exepid process 1156 61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exepid process 1156 61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exe 1156 61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exe 1156 61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exe 1156 61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exe"C:\Users\Admin\AppData\Local\Temp\61a711d8ad65c2600248a4cdfb6c61dd7adc958056503a32eb7fa856456e59df.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1156