e35947652d5348f426eb924d33ef17ccf73247c70cf407d0f28ab726f666ae7d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-1703_x64
resource
win10-20231220-en
resource tags

arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
submitted
29/12/2023, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

InvictaStealer.exe
Size

2.2MB
MD5

46eb69930070f98a1d04c4b1405a0b73
SHA1

3d9cb746fc06abfa125a7b27741b1f166fdeafd0
SHA256

e35947652d5348f426eb924d33ef17ccf73247c70cf407d0f28ab726f666ae7d
SHA512

319828ede2f89920821074c9d7da22ff0bb4a94537d53801882584f07c8e949348892e68e710806ae15191aca13b5972223faae1a25df153f6dbc52c608855d6
SSDEEP

24576:OOfsfKozBKHAhRh3KzPSA7R7Bt28SVSVlzyQOQZ9IEb68vL4R+2pYJeCYMXABtd:PBozBdhEV7q8bOQnIFWY+3Je0wl

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io

C:\Users\Admin\AppData\Local\Temp\InvictaStealer.exe
"C:\Users\Admin\AppData\Local\Temp\InvictaStealer.exe"
1⤵
PID:308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_W0_wE0_aE0_pE0_GB_{52439ee4-9f6b-11ee-8627-806e6f6e6963}_iinWaStuCy.zip

Filesize
34KB

MD5
92323b1ed4b170660ffad6f5436a189d

SHA1
f26ddc55c152d1fb121489463bc2b4bc9362dd63

SHA256
2000a60a608e2ad945eae153fcd3d9259da5e639f315607ea302d309553148f3

SHA512
a65831d657ee38086ce28a8247e86d94697e75a15361a99c9d7f49d8898d0106efd2b2f270d46e9cac5c4a8462133e0fa4c499553a56249669140894e4a944a2

Download Submit