Analysis
-
max time kernel
152s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 05:04
Static task
static1
Behavioral task
behavioral1
Sample
c93c90ecbd578abc34f566a6c6a0a75aff5ff59f89645d3b53f0fcdc43a5cfaa.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c93c90ecbd578abc34f566a6c6a0a75aff5ff59f89645d3b53f0fcdc43a5cfaa.exe
Resource
win10v2004-20220812-en
General
-
Target
c93c90ecbd578abc34f566a6c6a0a75aff5ff59f89645d3b53f0fcdc43a5cfaa.exe
-
Size
1.1MB
-
MD5
b4b33b11ad1d5c49f1d91915644b8294
-
SHA1
821279835ff864a2f4897a748199b146ff0de108
-
SHA256
c93c90ecbd578abc34f566a6c6a0a75aff5ff59f89645d3b53f0fcdc43a5cfaa
-
SHA512
c27a205392c5d50a496716adae870c9c2432e66105ca48c53124b4bfe238e39343af28cbb7ad7490576bf8d0f77da36516631855aae1b61bea1d8f2c8a6d6582
-
SSDEEP
24576:TMWCHMAScMMJLTkiRFVv8ZhSJ3ZTDjrBYhm:2sAdL9Tk88SjBwm
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2036-55-0x0000000000400000-0x00000000006CB000-memory.dmp upx behavioral1/memory/2036-57-0x0000000000400000-0x00000000006CB000-memory.dmp upx behavioral1/memory/2036-58-0x0000000000400000-0x00000000006CB000-memory.dmp upx behavioral1/memory/2036-59-0x0000000000400000-0x00000000006CB000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run c93c90ecbd578abc34f566a6c6a0a75aff5ff59f89645d3b53f0fcdc43a5cfaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c93c90ecbd578abc34f566a6c6a0a75aff5ff59f89645d3b53f0fcdc43a5cfaa.exe" c93c90ecbd578abc34f566a6c6a0a75aff5ff59f89645d3b53f0fcdc43a5cfaa.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.