Analysis
-
max time kernel
185s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 03:19
Static task
static1
Behavioral task
behavioral1
Sample
e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8.exe
Resource
win10v2004-20220901-en
General
-
Target
e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8.exe
-
Size
806KB
-
MD5
2ea5c7b10e35a3c0a933fab33cd3680e
-
SHA1
05a632f43490ee2f4616f79556d7258b5d4610fa
-
SHA256
e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8
-
SHA512
631a25d819f4d683afcaf3236397165f917f216436742a399c3577674a0bb32ed000729bfbad0f7dcc04ebce12f7199e7540fb14a09b9294b813d5c0862508e4
-
SSDEEP
24576:6PDj3jwfa5lRn5rzuSya7SZREAA7Byvpol7uPn:y33jwmlRhb7SZbPpFn
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/840-54-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral1/memory/840-55-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral1/memory/840-57-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral1/memory/840-58-0x0000000000400000-0x000000000063E000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8.exe" e8876c39b02320052d503ac58e25c933a698c80fbbfc096527e9b9bfee78f0e8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.