Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:45
Static task
static1
Behavioral task
behavioral1
Sample
7520afe6986d94353888f33e315cc497.exe
Resource
win7-20231215-en
General
-
Target
7520afe6986d94353888f33e315cc497.exe
-
Size
859KB
-
MD5
7520afe6986d94353888f33e315cc497
-
SHA1
53ad05c13e723138d6c9f4504df44f2c713dacbf
-
SHA256
69d679932d4e6e3ac60c70e7255f1a716d589c036b9d89fd649313806b3cdd5e
-
SHA512
d515649b9167537e9420566ba0303c33521a66202d3ce25a41810a3746ae95386c18f1dd52e256194826f727b9721be5609b7474d60eb9e85dfb5ef2f6b5470b
-
SSDEEP
12288:vVONXWALeaxJCdRCsp8srcqgiY7kLExBus21XR1qmGemsdOJM2DOkswyneKK9:INXWSeddRbKCy7kLaA1X/ksYu2DDnJ/
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1104-2-0x0000000001130000-0x000000000137C000-memory.dmp upx behavioral1/memory/1104-3-0x0000000001130000-0x000000000137C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7520afe6986d94353888f33e315cc497.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MozillaAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7520afe6986d94353888f33e315cc497.exe" 7520afe6986d94353888f33e315cc497.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
7520afe6986d94353888f33e315cc497.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7520afe6986d94353888f33e315cc497.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7520afe6986d94353888f33e315cc497.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 7520afe6986d94353888f33e315cc497.exe