Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 03:25
Static task
static1
Behavioral task
behavioral1
Sample
4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
General
-
Target
4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b.exe
-
Size
1.3MB
-
MD5
2ad0292603970385d449909e2f7a0a9d
-
SHA1
2eff36b7af2a35551a4a149425159cb7774a5ea5
-
SHA256
4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b
-
SHA512
11a1e33ea154e5b7bb71592e9be915429575bbb510e2f22696649fd38b775a0263f6bacae1c31b99f480a78d2c360bbeec9632c98bd0591872e06cc93f52701f
-
SSDEEP
24576:YfKf9qrhWQehAhcVdWhnOleV9rtENptZrAoQGcS1DZD:zVqrhi+hcVdWhd7OfZFQmZD
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1324 4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1324 4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b.exe 1324 4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b.exe 1324 4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b.exe 1324 4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b.exe"C:\Users\Admin\AppData\Local\Temp\4904e63b5ea692092aeab74b07ebbe36184f99d29e93e5090f6fc8158be6f05b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1324