Analysis

  • max time kernel
    185s
  • max time network
    195s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2022 03:19

General

  • Target

    e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8.exe

  • Size

    806KB

  • MD5

    2ea5c7b10e35a3c0a933fab33cd3680e

  • SHA1

    05a632f43490ee2f4616f79556d7258b5d4610fa

  • SHA256

    e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8

  • SHA512

    631a25d819f4d683afcaf3236397165f917f216436742a399c3577674a0bb32ed000729bfbad0f7dcc04ebce12f7199e7540fb14a09b9294b813d5c0862508e4

  • SSDEEP

    24576:6PDj3jwfa5lRn5rzuSya7SZREAA7Byvpol7uPn:y33jwmlRhb7SZbPpFn

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8.exe
    "C:\Users\Admin\AppData\Local\Temp\e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8.exe"
    1⤵
    • Adds Run key to start application
    PID:840

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/840-54-0x0000000000400000-0x000000000063E000-memory.dmp

    Filesize

    2.2MB

  • memory/840-55-0x0000000000400000-0x000000000063E000-memory.dmp

    Filesize

    2.2MB

  • memory/840-56-0x0000000076041000-0x0000000076043000-memory.dmp

    Filesize

    8KB

  • memory/840-57-0x0000000000400000-0x000000000063E000-memory.dmp

    Filesize

    2.2MB

  • memory/840-58-0x0000000000400000-0x000000000063E000-memory.dmp

    Filesize

    2.2MB