Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2023 15:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Excle.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
General
-
Target
Excle.exe
-
Size
93KB
-
MD5
5a0cdc8aed918501ad546276a89dff79
-
SHA1
9cf7cafd711e1735f61d202b8353bf6b4cbc8e25
-
SHA256
f414adb00f03f65ae0c2beb324117c44f1ea7e46b7efe10499bc387858a9b4a4
-
SHA512
2cfde2cab6ae917b53ce3730513a1978c48732105a82579f0d9ac0ea5621c6b316b306b4b8125367fb292e0d4b3bfb677f26250618716f2323d5f458eb90a6b5
-
SSDEEP
768:lPoGvw9AS5VebKWCk4ZudHYDPxLLLLLvH:J9v27mKWCk4UOH
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FireFox.url Excle.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1188 Excle.exe 1188 Excle.exe