7ccc114255ba0bec5a619fc5476a4b9598018474f5c0f64661e4cc104adc4032 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:13

Sharing

Report Analysis Logs

General

Target

Password Revealer 1.0/revealer.exe
Size

6KB
MD5

9eac4f44283241ac2a3878d7d96a2450
SHA1

a547fe7a58719c43c1d26bb38eadfa8392604c05
SHA256

aa5641a1b488c5fce674d4023714436e0668808d3fbc5e59a09c76d28cde0c9a
SHA512

82ef8663ea64d621515ce659d06dfafeff342a2d60d4e23cd6963d4a8ee8539f607846de7a1cb1518fb0020d8c783fe0168e08baa002254e6bbd3494c38e7a9f
SSDEEP

96:Gk6BZSZjZ4blAj+duSRMJTPpS8rsEvrU/49:GlTSZj2Aj+duSRoPhwEv6g

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/1952-0-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral3/memory/1952-1-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	revealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1952	revealer.exe

C:\Users\Admin\AppData\Local\Temp\Password Revealer 1.0\revealer.exe
"C:\Users\Admin\AppData\Local\Temp\Password Revealer 1.0\revealer.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1952-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download