Overview

overview

7

Static

static

1

5072de67dc...f0.exe

windows7-x64

7

5072de67dc...f0.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    174s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2024 11:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5072de67dcf16c12a1911398feab2cf0.exe

  • Size

    1.6MB

  • MD5

    5072de67dcf16c12a1911398feab2cf0

  • SHA1

    012d1167426859fadc70fa4d47507af412a11d6a

  • SHA256

    4c58806cd65b20a21a605b7e7a24075ad0975f215426e88c329fb314b0bab7bd

  • SHA512

    9e5e5a4b0c8958c40fd83e95c02fdee772820c04ac28f84bf629a6aabe6ea26e3902312c8d5dd396e9c2775574cf52e84a5aa709f1ffe57c9252da2df851cd3c

  • SSDEEP

    49152:l/fwUdLfGiPTStHxNtKgEAhK1kfqtOZ2Tw9rA:lwUdCi7KHs19tc6

Score
7/10
spywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5072de67dcf16c12a1911398feab2cf0.exe
    "C:\Users\Admin\AppData\Local\Temp\5072de67dcf16c12a1911398feab2cf0.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Users\Admin\AppData\Local\Temp\5072de67dcf16c12a1911398feab2cf0.exe
      "C:\Users\Admin\AppData\Local\Temp\5072de67dcf16c12a1911398feab2cf0.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_b24232980"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\pkg_b24232980\autorun.txt
    Filesize

    85B

    MD5

    dcf1cecaa23b23ef8fd2b8fff8110c58

    SHA1

    2d6e439a144e2396b82a78dabaedfc52befe1c2a

    SHA256

    92466fb6f101690250b520fb4e157e184f1682cccc6aa6d7f5887efd953057c2

    SHA512

    46e37743828113e358a47203fb2fac08c54e59bff4fac4679b083c800bd8a2d50754eeaa69d53e8991a95ed5f199d3d555e61443784e3ea8ed0e7d7d403a3916

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\pkg_b24232980\wrapper.xml
    Filesize

    798B

    MD5

    1d45a29e3511b982a1f91b33c70e964f

    SHA1

    176a47b489be3f27dc354a2b9dd0b580bb2f3904

    SHA256

    0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

    SHA512

    c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

    Download Submit