Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03-01-2024 15:04
Behavioral task
behavioral1
Sample
Credit Hack Orange.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Credit Hack Orange.exe
-
Size
196KB
-
MD5
75946508a03687238c181ef71a4cbc8a
-
SHA1
6bc3a51f74397f7cc32350883732bd65b6415f60
-
SHA256
26ccc4ea45bcaeab5c3bbd5b616e3db93c3f860aeedc71c4c33f91862e40263a
-
SHA512
af932a93019935996e04316d682716e1b6de6f9d213e7dce00aa7a3d02a01b59da3c3326838f59a449eb86b6c957298f99a6a4899d0366c1c4dc7cc48e7705cf
-
SSDEEP
3072:oTqPRLyeIKDWx85IOlKeJVos/8eRwXiUUAdV95I4Rp+LH1xrl3Ez8ub8Xr:oTqPRLdIKCC0ef//uXltKc+LVsz9b8
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2208-2-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2208-4-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2208-5-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2208-6-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2208-8-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Credit Hack Orange.exedescription pid process target process PID 1340 set thread context of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Credit Hack Orange.exepid process 1340 Credit Hack Orange.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Credit Hack Orange.exedescription pid process target process PID 1340 wrote to memory of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe PID 1340 wrote to memory of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe PID 1340 wrote to memory of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe PID 1340 wrote to memory of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe PID 1340 wrote to memory of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe PID 1340 wrote to memory of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe PID 1340 wrote to memory of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe PID 1340 wrote to memory of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe PID 1340 wrote to memory of 2208 1340 Credit Hack Orange.exe Credit Hack Orange.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Credit Hack Orange.exe"C:\Users\Admin\AppData\Local\Temp\Credit Hack Orange.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Credit Hack Orange.exe/scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2208-2-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2208-4-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2208-5-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2208-6-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2208-8-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB