Analysis
-
max time kernel
124s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 04:39
Static task
static1
Behavioral task
behavioral1
Sample
eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe.exe
-
Size
973KB
-
MD5
10ef0dd72f836e9daa6a4d5e3a20fde0
-
SHA1
fc27975a39378ce5b48a44035db99f83d0b556bc
-
SHA256
eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe
-
SHA512
cb53ca1a0ebc392aeca5e761f25111ad63b382310bb5fc2a82f69024301ec963da2ab05711bf4c8eb890ad854b016dbcadc7d1ee6f5e5c85cbbfc361703315af
-
SSDEEP
24576:K+wU+0GRJBMyaosJdRnPUKGh6qltQpoRGbkZMA0uSrri7wH5:IR0GRJ5RsBPUKGhtQugkZOWa5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 952 eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 952 eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe.exe 952 eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe.exe 952 eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe.exe 952 eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe.exe"C:\Users\Admin\AppData\Local\Temp\eccd727cb409575e04c138f9784b9e7b48bc0adc76514bebbbecc5ffbddf29fe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:952