Analysis
-
max time kernel
165s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 18:59
Behavioral task
behavioral1
Sample
cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exe
Resource
win7-20220812-en
General
-
Target
cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exe
-
Size
916KB
-
MD5
e4f8d622882824ab3fdaf94e039b69b0
-
SHA1
c4284413fe3ecb522a85c65e540c1f8f8f542864
-
SHA256
cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392
-
SHA512
71705f8e39b2e50deefda2bf8ccb17f9591e1a53e73dbae7da3d119bc4a7437b58ecc8365ea4dd58786ebfbd89debda104048f8f94644f8ca762f4db3903aaf0
-
SSDEEP
24576:kJnav4dbkHXlQTlACio/uyy5150XxiRE/V0:4av48X+TlAfUoteF/W
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
setup.exepid process 4548 setup.exe -
Processes:
resource yara_rule behavioral2/memory/2512-132-0x00000000009A0000-0x0000000000C56000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\setup.exe upx C:\Users\Admin\AppData\Local\Temp\setup.exe upx behavioral2/memory/2512-136-0x00000000009A0000-0x0000000000C56000-memory.dmp upx behavioral2/memory/4548-137-0x0000000000F10000-0x00000000011C6000-memory.dmp upx behavioral2/memory/4548-138-0x0000000000F10000-0x00000000011C6000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exesetup.exepid process 2512 cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exe 2512 cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exe 4548 setup.exe 4548 setup.exe 4548 setup.exe 4548 setup.exe 4548 setup.exe 4548 setup.exe 4548 setup.exe 4548 setup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exedescription pid process target process PID 2512 wrote to memory of 4548 2512 cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exe setup.exe PID 2512 wrote to memory of 4548 2512 cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exe setup.exe PID 2512 wrote to memory of 4548 2512 cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exe setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exe"C:\Users\Admin\AppData\Local\Temp\cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe relaunch2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
916KB
MD5e4f8d622882824ab3fdaf94e039b69b0
SHA1c4284413fe3ecb522a85c65e540c1f8f8f542864
SHA256cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392
SHA51271705f8e39b2e50deefda2bf8ccb17f9591e1a53e73dbae7da3d119bc4a7437b58ecc8365ea4dd58786ebfbd89debda104048f8f94644f8ca762f4db3903aaf0
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
916KB
MD5e4f8d622882824ab3fdaf94e039b69b0
SHA1c4284413fe3ecb522a85c65e540c1f8f8f542864
SHA256cf27b209fcd886588acddd28eb8a5418459952c1d7262e1ed47c881e8810c392
SHA51271705f8e39b2e50deefda2bf8ccb17f9591e1a53e73dbae7da3d119bc4a7437b58ecc8365ea4dd58786ebfbd89debda104048f8f94644f8ca762f4db3903aaf0
-
memory/2512-132-0x00000000009A0000-0x0000000000C56000-memory.dmpFilesize
2.7MB
-
memory/2512-136-0x00000000009A0000-0x0000000000C56000-memory.dmpFilesize
2.7MB
-
memory/4548-133-0x0000000000000000-mapping.dmp
-
memory/4548-137-0x0000000000F10000-0x00000000011C6000-memory.dmpFilesize
2.7MB
-
memory/4548-138-0x0000000000F10000-0x00000000011C6000-memory.dmpFilesize
2.7MB