Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 13:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a.exe
-
Size
348KB
-
MD5
faa8eaed63c4e9f212ef81e2365dd9e8
-
SHA1
0d3a5725b6f740929b51f9a8611b4f843e2e07b1
-
SHA256
b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a
-
SHA512
eac27866c3719d59d285cbfd1fd8a85da67ce527c54104aee9d087e11966090f00266c2c85209d2a6a80085ee869745a97834b9de50c694e77f0a4eff106d8bc
-
SSDEEP
6144:vtiSdpwpk2cBAL5GVmC3zgq7fqEvangAYSpMYrbne8zNK1iy/6CWAzj:1iqwpkvBAL5GpzgsBvtfyajFhzj
Malware Config
Signatures
-
Detect WinDealer information stealer 2 IoCs
resource yara_rule behavioral1/memory/2236-0-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral1/memory/2236-1-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2236 b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a.exe 2236 b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a.exe"C:\Users\Admin\AppData\Local\Temp\b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a.exe"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2236