Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 23:16

General

  • Target

    b5e7bb1f318acdd786fbb3264ff1f359.exe

  • Size

    669KB

  • MD5

    b5e7bb1f318acdd786fbb3264ff1f359

  • SHA1

    a0d9421024e156ae4a0b2c5ee93efb55fd0bc548

  • SHA256

    5a93f3184f9990944957223f711d7982553f0021de9017b46d4f4cfbb22b0ea1

  • SHA512

    665e8172284648a184c3c75709981546a4a1c3f1dd8f265f01195c40fca87ee8eb4dfb398f8b567f21734a01ac3604a9d76518364ea8d2ea119b2464ad179002

  • SSDEEP

    12288:IexhH6HiUVUEPVCWpj7Vy5bwmF6KpvoI+QcGcf7S5DGbJpZUeVG3:IuV6HiUVTPVCWuwmFNvoI7cjSdGxUq+

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b5e7bb1f318acdd786fbb3264ff1f359.exe
    "C:\Users\Admin\AppData\Local\Temp\b5e7bb1f318acdd786fbb3264ff1f359.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\truste.jpg

    Filesize

    5KB

    MD5

    1959eb33004d6107d3412e109c37b742

    SHA1

    59c3a787483e7743d5b805cd36726a0bec7e4992

    SHA256

    e60a764cd4d721c9fd261555510c51c668d112a37f2da2f0be1da6dceaa5f8ad

    SHA512

    238724a6b809d371c6ebab6057c61019e48caf7dd3245c6dca77efb5c015703a206472a9b82f778114c8dce3f10dd13fba972644b137020e4e5507053358e68e