Analysis
-
max time kernel
158s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 00:28
Behavioral task
behavioral1
Sample
08918c06d20e01d9a5f003c341fe8169.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
08918c06d20e01d9a5f003c341fe8169.exe
Resource
win10v2004-20231215-en
General
-
Target
08918c06d20e01d9a5f003c341fe8169.exe
-
Size
2.1MB
-
MD5
08918c06d20e01d9a5f003c341fe8169
-
SHA1
e0c8b93ac8540583e0a37421f52a60930843332c
-
SHA256
21d20ce91854c9022a77f5a22d3c7497e2d1091e1cac0a17c75b1c1faeb44dcd
-
SHA512
ec2adaa9d10c71fce310780bd1e2424af0e7bd948c7cea1fbc9c2d0206af18e608f821834b1f23983716d5966f0c97ba7aee1bc0da1b996977e4d73ff13bfe0f
-
SSDEEP
49152:NAs3i3iN2daZwHig3wFTn9212Mt8Zmr+OPnmRGr6dgBJUu9XjBI:qIKigpRWU1ht84r+dGUsI
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2516-0-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-1-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-8-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-9-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-10-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-11-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-12-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-13-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-14-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-16-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-17-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-18-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-19-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-20-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-21-0x0000000000C50000-0x00000000013B0000-memory.dmp upx behavioral2/memory/2516-22-0x0000000000C50000-0x00000000013B0000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\capfam = "\"C:\\Users\\Admin\\AppData\\Local\\gcc.exe\"" 08918c06d20e01d9a5f003c341fe8169.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 27 Go-http-client/1.1