Analysis
-
max time kernel
67s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
01-12-2022 06:03
General
-
Target
2bef228a837f3d485462eb8dacd7c04833219ee77f45b0af0ca938b57f45a389.exe
-
Size
1.0MB
-
MD5
54f4e983d596ad5487f2e3e0c1456f69
-
SHA1
7b22bf420ab71e14c7ad3825a093182c487285f5
-
SHA256
2bef228a837f3d485462eb8dacd7c04833219ee77f45b0af0ca938b57f45a389
-
SHA512
7c2f209a2190447e6e8102bc85a75a1359db189646a996ac3c305cbea5112657a6493961eef49f71584cdfcf873942dd4538adfd27afb60170b268e97e3165d8
-
SSDEEP
24576:OB8+mu4DXEz/XVsR0FJc78OhJBgRPflYm8CcP2FRGmbl+aoNtmQ:OOgWe+EYmEaoNP
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bef228a837f3d485462eb8dacd7c04833219ee77f45b0af0ca938b57f45a389.exe"C:\Users\Admin\AppData\Local\Temp\2bef228a837f3d485462eb8dacd7c04833219ee77f45b0af0ca938b57f45a389.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2bef228a837f3d485462eb8dacd7c04833219ee77f45b0af0ca938b57f45a389.exe"C:\Users\Admin\AppData\Local\Temp\2bef228a837f3d485462eb8dacd7c04833219ee77f45b0af0ca938b57f45a389.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
-
Filesize
980KB
-
Filesize
8KB
-
Filesize
980KB
-
Filesize
980KB