Overview

overview

7

Static

static

1

5ae776da38...5c.exe

windows7-x64

7

5ae776da38...5c.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    88s
  • max time network
    228s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 06:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5ae776da383c2619b2c0e662d789555c.exe

  • Size

    1.6MB

  • MD5

    5ae776da383c2619b2c0e662d789555c

  • SHA1

    5a4c2528100b2727b26c0b30297d380a1730d8c0

  • SHA256

    6983ef290e8760febb4dd373f991fec87b4e7957b09a665e06afab4fc1da58e2

  • SHA512

    1d820d8a46cf68a3bdbc0b8c940cdc23d6cc477afad9d18f63bdd032fe3865d48c40bebb20d82a1b12a0d818c1f63005f481253a172fef336dfa2d8e1fc0146e

  • SSDEEP

    49152:r/fwUdeRW1s5ycjkcSZEDghtAkf4tJh8TNkrB:rwUdf1GXj6BGt3Z

Score
7/10
spywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ae776da383c2619b2c0e662d789555c.exe
    "C:\Users\Admin\AppData\Local\Temp\5ae776da383c2619b2c0e662d789555c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Users\Admin\AppData\Local\Temp\5ae776da383c2619b2c0e662d789555c.exe
      "C:\Users\Admin\AppData\Local\Temp\5ae776da383c2619b2c0e662d789555c.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_b1552f90"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1920

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\pkg_b1552f90\autorun.txt
          Filesize

          91B

          MD5

          84e5bf4462d5a0b56a05451efec9ecb2

          SHA1

          d8aeab9106e8b4dc33fa9792533d03397a103b86

          SHA256

          732ca87ee5ad3329bd5faac6d98f9bffc677d7d4312187ffbde6935c9dc4e96e

          SHA512

          e42fc8eb4d58592cd23e5f84e8faf2942854ef79f2ff04d589a16346956e2e1c002e5d256c9e83732f637ae8c099482bb264dba66598dbe9d711dd9cde47229f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\pkg_b1552f90\wrapper.xml
          Filesize

          798B

          MD5

          1d45a29e3511b982a1f91b33c70e964f

          SHA1

          176a47b489be3f27dc354a2b9dd0b580bb2f3904

          SHA256

          0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

          SHA512

          c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

          Download Submit