Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 12:39
Behavioral task
behavioral1
Sample
36753b4e0c6f797e3dec502350619929.dll
Resource
win7-20231129-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
36753b4e0c6f797e3dec502350619929.dll
Resource
win10v2004-20231222-en
5 signatures
150 seconds
General
-
Target
36753b4e0c6f797e3dec502350619929.dll
-
Size
6.3MB
-
MD5
36753b4e0c6f797e3dec502350619929
-
SHA1
cadbe1ed88d23a44ec0655e8a4a5cea644435108
-
SHA256
d1b39b582a79fc52b7d49015c757ee747fddcfde0c16441b68bb5e72dce8ceba
-
SHA512
96ee897ba371b7aec68e4604845bece5bf79083326724f6840525412e823b0e11acf8085429f6cf3c65b8868f8df3f1e15efa739701a1163ff2af1d4b8c9d95c
-
SSDEEP
98304:HIXHCYrOtuZGHlQTCZOWE/R4HKuZYAp0ctSrdXzaDbq+VGPtmr97/vXE:HIXimOtu+LGeQAqgGgNz57k
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2272-0-0x00000000727A0000-0x0000000073315000-memory.dmp vmprotect behavioral1/memory/2272-7-0x00000000727A0000-0x0000000073315000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2272 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2272 rundll32.exe 2272 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2272 2076 rundll32.exe 18 PID 2076 wrote to memory of 2272 2076 rundll32.exe 18 PID 2076 wrote to memory of 2272 2076 rundll32.exe 18 PID 2076 wrote to memory of 2272 2076 rundll32.exe 18 PID 2076 wrote to memory of 2272 2076 rundll32.exe 18 PID 2076 wrote to memory of 2272 2076 rundll32.exe 18 PID 2076 wrote to memory of 2272 2076 rundll32.exe 18
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36753b4e0c6f797e3dec502350619929.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36753b4e0c6f797e3dec502350619929.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2272
-