Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 07:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe
-
Size
56KB
-
MD5
7c7ade1083e118986c4f049523ccb3c8
-
SHA1
a861989b4106dd1b73c12fbfb048d8f285c48641
-
SHA256
8a464e38787861dbcc21e719d509cc4534a013ea9cc9d4ff2c849d33c21db3cd
-
SHA512
838da41f8d18ae3703ff66c5c089000362d3d16d6026f1ec6e99751f34fa26ddf332f231fb241b363d72637538ceb2bf5651f751697763900ffff716f7fe517c
-
SSDEEP
768:lv8GjOdyiZNATDkTglSJ520ocooyj+z0L64dvPGZBgb2o:yG6dyiZGkmS2PcRzWPbb2o
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
ihatenarbs
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4744 SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4744 SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4744 SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe"C:\Users\Admin\AppData\Local\Temp\SPARC MAC'S LEAKED GUIDE TO 200M IN 7 DAYS.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4744