Analysis

  • max time kernel
    152s
  • max time network
    179s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 12:54

General

  • Target

    8381b8e4c30d15ec23cd8ccd5adf3da7a85797d4f88db02063b5f94fe48e7489.exe

  • Size

    863KB

  • MD5

    b55ed7d43380eef1611705494ed3e6a2

  • SHA1

    f8aeb39c299c41b5cdc3ab951d4c4489cb7b1ba9

  • SHA256

    8381b8e4c30d15ec23cd8ccd5adf3da7a85797d4f88db02063b5f94fe48e7489

  • SHA512

    89fc94ba138f4e1c329f3833bf03e5412100c24be90a1d94c2908aeefda3f7ec9af6741697c10e742f085f2aa928f0ea56565380bf050ac615bf7f469f0998df

  • SSDEEP

    24576:chdTBERwhrCvGgP3LxdbTY7FNCweaFcpVGTajhCx3fNM:ODrIP3jTY7TCoUGaMK

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8381b8e4c30d15ec23cd8ccd5adf3da7a85797d4f88db02063b5f94fe48e7489.exe
    "C:\Users\Admin\AppData\Local\Temp\8381b8e4c30d15ec23cd8ccd5adf3da7a85797d4f88db02063b5f94fe48e7489.exe"
    1⤵
    • Adds Run key to start application
    • Checks processor information in registry
    PID:888

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/888-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

    Filesize

    8KB

  • memory/888-55-0x0000000000960000-0x0000000000A70000-memory.dmp

    Filesize

    1.1MB

  • memory/888-56-0x0000000002120000-0x00000000021EE000-memory.dmp

    Filesize

    824KB

  • memory/888-57-0x00000000003E0000-0x000000000062C000-memory.dmp

    Filesize

    2.3MB

  • memory/888-58-0x00000000003E0000-0x000000000062C000-memory.dmp

    Filesize

    2.3MB