Analysis
-
max time kernel
33s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 05:11
Static task
static1
Behavioral task
behavioral1
Sample
89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c.exe
Resource
win7-20220812-en
3 signatures
150 seconds
General
-
Target
89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c.exe
-
Size
973KB
-
MD5
7c84b7749be1690f2c98f8c274987193
-
SHA1
a56805af4a30e1ab67a2d76d69fda9d8ddf51b78
-
SHA256
89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c
-
SHA512
893bef3e7be1c8bec5af7b4f1042a02989bf51b290a9ad18be9131e2e12831069d6c795800ba7cf610148462315c1910d811082f63c6f26e2b1839f052af2d98
-
SSDEEP
24576:K+wU+0GRJBMyaosJdRnPUKGh6qltQpoRGbkZMA0uSrrG7wH5:IR0GRJ5RsBPUKGhtQugkZOya5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2036 89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2036 89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c.exe 2036 89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c.exe 2036 89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c.exe 2036 89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c.exe"C:\Users\Admin\AppData\Local\Temp\89e5e130d249c76a4f886709c6f93d279753761872a3fa34e44084379699f01c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2036