Analysis

  • max time kernel
    17s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 16:29

General

  • Target

    fd0a451bf04a9dd151a48ea4ec7a33ad844089f8fca6ed3b7dad31af539aa4b2.exe

  • Size

    961KB

  • MD5

    34634387024a989447acc39c328f3070

  • SHA1

    66f3dc15f795e35a3a7eb1afca2f54a6a3bcbc36

  • SHA256

    fd0a451bf04a9dd151a48ea4ec7a33ad844089f8fca6ed3b7dad31af539aa4b2

  • SHA512

    aba4b32eed4f31a39a303aad8279ff5170ef2712138f429417bf3280e943de29bcde8c9100509aad2cefea0598b94dbfecf58292096dadfd808ca170c5c98c47

  • SSDEEP

    24576:ikQ1aOCco82PkHsddUplpYE+JglzGWqVgjsaxZiAvS5cSDS:r/co82CsrUplpYEZ1BjsEZy8

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd0a451bf04a9dd151a48ea4ec7a33ad844089f8fca6ed3b7dad31af539aa4b2.exe
    "C:\Users\Admin\AppData\Local\Temp\fd0a451bf04a9dd151a48ea4ec7a33ad844089f8fca6ed3b7dad31af539aa4b2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1912-54-0x0000000076041000-0x0000000076043000-memory.dmp
    Filesize

    8KB