Analysis
- max time kernel
70s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
02/01/2023, 13:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
89b68d190315e6476b0a8b135e6e515ab931c10a.exe
Resource
win7-20221111-en
3 signatures
150 seconds
General
- Target 89b68d190315e6476b0a8b135e6e515ab931c10a.exe
- Size 459KB
- Sample230102-p9yt9aec36
- SHA256 72c3a786661ee9742cf1d0e3b99b89e976911ed87971695f08487cf42d7fc29d
- MD5 1edba8a76c4a327f6e0b81e85c14ede6
- SHA1 89b68d190315e6476b0a8b135e6e515ab931c10a
- SHA512 3347452e348f52a17a787574136d8d0fccc70511205e47bd2fdc546718b87d22f9280621bc5a849c6b5834e1226a453ccc1657ff34f63877f052713ca9710562
- SSDEEP 12288:/38LUKZp2WDqHIbwMUUjLZUJtUp23vqmkgB:/OTp2CqHczjlUJtUp23vtB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3096 89b68d190315e6476b0a8b135e6e515ab931c10a.exe 3096 89b68d190315e6476b0a8b135e6e515ab931c10a.exe 3096 89b68d190315e6476b0a8b135e6e515ab931c10a.exe 3096 89b68d190315e6476b0a8b135e6e515ab931c10a.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3096 89b68d190315e6476b0a8b135e6e515ab931c10a.exe