Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-01-2024 01:04
Static task
static1
Behavioral task
behavioral1
Sample
7e7822f69c846dd80383043b01797365.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7e7822f69c846dd80383043b01797365.exe
Resource
win10v2004-20231215-en
General
-
Target
7e7822f69c846dd80383043b01797365.exe
-
Size
821KB
-
MD5
7e7822f69c846dd80383043b01797365
-
SHA1
906d86b126d396f255de955547b5aae79f92f819
-
SHA256
199b60d7df03718bbc7e90322026a12227568e9c0400e241c67ace01f91314b5
-
SHA512
d6da1dde5136b4071204ab2957d1b10ae892119f71e01767801b298475ffc0fe375bd0add10b8b33eb0d8e4310ba15858eee816e53480442f1fc19d238babe32
-
SSDEEP
24576:36Ut3vzno9aYk9KUHOLZTlJrQbYTGdgJpCbbSt:ht3U9g9K4oZJJrQbYTGdg31
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2360-2-0x0000000000A20000-0x0000000000C4C000-memory.dmp upx behavioral1/memory/2360-3-0x0000000000A20000-0x0000000000C4C000-memory.dmp upx behavioral1/memory/2360-7-0x0000000000A20000-0x0000000000C4C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SmartIndex = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7e7822f69c846dd80383043b01797365.exe" 7e7822f69c846dd80383043b01797365.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.