Analysis
-
max time kernel
1740s -
max time network
1156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12-10-2023 00:11
General
-
Target
F5C67FE00B4CBEE07D5E394C87F0C6224BBD841A92151.exe
-
Size
1.1MB
-
MD5
842ae8e819177105e1a1af934b1ee520
-
SHA1
17104eca148dcd0e15ffb31e4c7a3defdd406d12
-
SHA256
f5c67fe00b4cbee07d5e394c87f0c6224bbd841a92151d04841f584d56e58b0c
-
SHA512
b92ecfb5c89996332dd674682694a111aee2bc26b21678c9e60dc592272b91a0f6e9d2a478528b6f257290c5ef43ed9d87d7fac3b8314e768144951333e4916d
-
SSDEEP
24576:zXdmFGXOGXlTztlj3RbjO7jlUIixAWLc7ARpTLzVONY/tx4:rdfLVTLjxwjlQntT/VO2x4
Score
10/10
Malware Config
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\F5C67FE00B4CBEE07D5E394C87F0C6224BBD841A92151.exe"C:\Users\Admin\AppData\Local\Temp\F5C67FE00B4CBEE07D5E394C87F0C6224BBD841A92151.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses