Analysis
-
max time kernel
175s -
max time network
189s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
58de13ab2726f5ba203fcd9323830d37.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
58de13ab2726f5ba203fcd9323830d37.exe
Resource
win10v2004-20231215-en
General
-
Target
58de13ab2726f5ba203fcd9323830d37.exe
-
Size
716KB
-
MD5
58de13ab2726f5ba203fcd9323830d37
-
SHA1
a77a340d63e6f6514bce29f4e100cd872e23bc3f
-
SHA256
e5fac1d1d2ba4616d9c525233a819ce1b4bd2f28e906562a1cb5a61ff73d1567
-
SHA512
ccd88012cb94ea491bde49ec421bc3748b4bf80501e74855c5180cf0330210f6f19d485d4a23ef24fe70f471424b187752f988d690bfb4ac24bf501e8c5b2420
-
SSDEEP
12288:wIea+MbZQknFU0GLzhAli0g6+TNm6ovS+UCOjuILrAoVJAtOYr/P8Te+OkJmR9WV:wIUknF2n+AH6H/UCOj3r/ItpbPqe+9JJ
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2892-1-0x0000000000400000-0x0000000000603000-memory.dmp upx behavioral1/memory/2892-4-0x0000000000400000-0x0000000000603000-memory.dmp upx behavioral1/memory/2892-5-0x0000000000400000-0x0000000000603000-memory.dmp upx behavioral1/memory/2892-6-0x0000000000400000-0x0000000000603000-memory.dmp upx behavioral1/memory/2892-7-0x0000000000400000-0x0000000000603000-memory.dmp upx behavioral1/memory/2892-18-0x0000000000400000-0x0000000000603000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SmartIndex = "C:\\Users\\Admin\\AppData\\Local\\Temp\\58de13ab2726f5ba203fcd9323830d37.exe" 58de13ab2726f5ba203fcd9323830d37.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.