Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
42225c3a51b12d47a4258a08a247a083.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
42225c3a51b12d47a4258a08a247a083.exe
Resource
win10v2004-20231215-en
General
-
Target
42225c3a51b12d47a4258a08a247a083.exe
-
Size
870KB
-
MD5
42225c3a51b12d47a4258a08a247a083
-
SHA1
9ae960c7c69bad51da4ddbbbbc0c6600b40a0e4f
-
SHA256
8e73fe7dcd1e6f290f0492a064da433a7401a99be1dd9acb7f6a04dcf34ab7d3
-
SHA512
87c076ddcb6b17c90edbf16bd294308874c83debee817bfd71e24d10381df768822a71507c2f46cb3c85db3b9bbe7853e7feb525bc2de0ae61a1f37ba9b911bb
-
SSDEEP
12288:9pkuu4SughmvmaDtCN/LTSAUc24OszNb3MiTdBxFVCQyWxUYA5E:Tkuu4F0mrDC/LTTQv6qiTdBv7dzA
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1264-1-0x0000000000400000-0x000000000060B000-memory.dmp upx behavioral1/memory/1264-3-0x0000000000400000-0x000000000060B000-memory.dmp upx behavioral1/memory/1264-4-0x0000000000400000-0x000000000060B000-memory.dmp upx behavioral1/memory/1264-5-0x0000000000400000-0x000000000060B000-memory.dmp upx behavioral1/memory/1264-6-0x0000000000400000-0x000000000060B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SonyAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\42225c3a51b12d47a4258a08a247a083.exe" 42225c3a51b12d47a4258a08a247a083.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.