Overview

overview

7

Static

static

1

7f8bde8f1f...fc.exe

windows7-x64

7

7f8bde8f1f...fc.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2024 09:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7f8bde8f1fbcf03af78f039cfb0454fc.exe

  • Size

    1.6MB

  • MD5

    7f8bde8f1fbcf03af78f039cfb0454fc

  • SHA1

    7d3728c8b7cea9afa4b821a5fc9ffa808e13f613

  • SHA256

    fa6f4a32feeead916150557f90b35b49ce6c3fc57e33511136f1716fec9c0a1b

  • SHA512

    bd5aad746b12895d96a64187042b0ebf5d2e6dd23cb210209d85e38f5bc5c529cd25beba33c0c9dace93b308bdd0c817d70faaba36a3fe002b67837eb0bf10cd

  • SSDEEP

    49152:I/fwhofLeH4si17tnyKl6ZAZ5a0mLTqBrp:IwhweHxiUMax8

Score
7/10
spywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f8bde8f1fbcf03af78f039cfb0454fc.exe
    "C:\Users\Admin\AppData\Local\Temp\7f8bde8f1fbcf03af78f039cfb0454fc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Users\Admin\AppData\Local\Temp\7f8bde8f1fbcf03af78f039cfb0454fc.exe
      "C:\Users\Admin\AppData\Local\Temp\7f8bde8f1fbcf03af78f039cfb0454fc.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_93a201c10"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\pkg_93a201c10\autorun.txt
    Filesize

    75B

    MD5

    dedd637ddbf046e30073a331661f9c07

    SHA1

    ab5f8164ea28c3b43ef05d20a45fe05d56b55362

    SHA256

    ea421d768126b1dcd0892be805e7cd22c1ccc662cd744bc4bac801264be8e722

    SHA512

    c8d63d624c71ed717dfedf3940c5a3983f9b5626c16a2ff4357ad3c02f20040742d8ad33247cc0b60c1ce82ca4b57fd402ddb7e27fe04138f37f152725a1fd65

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\pkg_93a201c10\wrapper.xml
    Filesize

    798B

    MD5

    1d45a29e3511b982a1f91b33c70e964f

    SHA1

    176a47b489be3f27dc354a2b9dd0b580bb2f3904

    SHA256

    0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

    SHA512

    c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

    Download Submit