Analysis
- max time kernel
239s - max time network
249s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2022, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe
Resource
win7-20221111-en
3 signatures
150 seconds
General
- Target d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe
- Size 973KB
- Sample221127-py3n3acg3s
- SHA256 d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481
- MD5 48c5fe6ee3c73e9dee697bd4d6ae08e6
- SHA1 8220ffe1e5c62e36a14510071b0486fa5aa9d629
- SHA512 5d5c2b39e34845ec79360b692cae85196db1bd2cb1e3c0ed2771ed72258297f030bade556b61c8ee334325b2fbc4990e2ab81b9c72f0908763a711590680c1ab
- SSDEEP 24576:K+wU+0GRJBMyaosJdRnPUKGh6qltQpoRGbkZMA0uSrr17wH5:IR0GRJ5RsBPUKGhtQugkZOXa5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2180 d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe 2180 d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2180 d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe 2180 d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe 2180 d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe 2180 d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe"C:\Users\Admin\AppData\Local\Temp\d611593bdac2721ddae12f58b1dfbb2ff27bd9e6e52627944fa99dd0991f2481.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2180