Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 11:17

General

  • Target

    1a2a560e957632f80f8ee2c9dda7d3a0.exe

  • Size

    5.1MB

  • MD5

    1a2a560e957632f80f8ee2c9dda7d3a0

  • SHA1

    9e478fa93cfc65a245c3931dbca47f5f985d74f1

  • SHA256

    6c5d271ef639c261074a126ceec0218cbc578229411a273d92647a549d9f4429

  • SHA512

    0e2232bc5f499509f43e1e755492356d98713d0b9cd68c128ca00ac8c15fb4407650ada50b7c5b02f65291c8f79bc1a5297d1c4eca650df61b46aa29f777d51d

  • SSDEEP

    98304:+JJjHr7onSkPKok4M+cSZcRxhToIGTCCfJakPIFzi5PpX:6JjHHo+F4yRRIBxNPIFzkpX

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a2a560e957632f80f8ee2c9dda7d3a0.exe
    "C:\Users\Admin\AppData\Local\Temp\1a2a560e957632f80f8ee2c9dda7d3a0.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2268-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2268-2-0x0000000000400000-0x0000000000C9F000-memory.dmp

    Filesize

    8.6MB

  • memory/2268-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2268-5-0x0000000000400000-0x0000000000C9F000-memory.dmp

    Filesize

    8.6MB

  • memory/2268-7-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2268-13-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2268-11-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2268-9-0x0000000077370000-0x0000000077371000-memory.dmp

    Filesize

    4KB

  • memory/2268-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2268-17-0x0000000000400000-0x0000000000C9F000-memory.dmp

    Filesize

    8.6MB