Analysis
-
max time kernel
157s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18-04-2024 02:24
General
-
Target
f082b3d46adb5bb3a7aca15811072c6557a9440fd370519d8cdef3a7a13de0cd.exe
-
Size
20.4MB
-
MD5
a665aa5d659fe996cf654cebb1e73fa4
-
SHA1
59ff218a45bd07f8dcb01f817a33f96aebb71494
-
SHA256
f082b3d46adb5bb3a7aca15811072c6557a9440fd370519d8cdef3a7a13de0cd
-
SHA512
8b30189d505b0ac64855d5d2cfbae7dfa8054cf90f6cc03c5428c535fe3e5f85f0fbdc3db3a2d91289b5dd247499075089883c41ed603604a275b20ed456542f
-
SSDEEP
393216:edjtBby8b52AALjVabxtndRX7hbggeP7rq7NcpRHbloVMbyktxFFN:exthwAALxa3ndR7hsg8Rd2kt5N
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f082b3d46adb5bb3a7aca15811072c6557a9440fd370519d8cdef3a7a13de0cd.exe"C:\Users\Admin\AppData\Local\Temp\f082b3d46adb5bb3a7aca15811072c6557a9440fd370519d8cdef3a7a13de0cd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QG2SS.tmp\f082b3d46adb5bb3a7aca15811072c6557a9440fd370519d8cdef3a7a13de0cd.tmp"C:\Users\Admin\AppData\Local\Temp\is-QG2SS.tmp\f082b3d46adb5bb3a7aca15811072c6557a9440fd370519d8cdef3a7a13de0cd.tmp" /SL5="$901E0,20903158,158720,C:\Users\Admin\AppData\Local\Temp\f082b3d46adb5bb3a7aca15811072c6557a9440fd370519d8cdef3a7a13de0cd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD5b43f1c9e0a21f85c00e73d3de946cde1
SHA1cc71f9b1349a3e54e48a0d0781d69fad28b5ec24
SHA2566eac0fc6c55f21899c085066c8a5170ba90f79b56562d0dad6d99ddc310ad087
SHA5128eaaedcd5282eb55f10b2f99fcf5e71ef48b812971cb721887775c30fc7f1692f71aa2d9248f0b859b0ad4ce42d91f22ea72c4940548efe78a192b6353650f0a
-
Filesize
3KB
MD51c4efc4d4c081af62f7b2d92f00fbbc0
SHA1f6ccecce05b5718b84a39102af857f7a5b05d262
SHA256bd14d07140d13451b4ce2dc20167303d8559fa8bb512e5375621eab2b303cecc
SHA512870363c09ff5dbac1d7fb8d099a6cab1a76e7bb3f33c8307f886db4d9ebaa60e2c8bd4565dfb3d0a5be60671de9b6e896fadc907e856a3ccad3f6c7c6f21e070
-
Filesize
165KB
MD561ad4bfdb2885d3497596dfad2889c9a
SHA1991979ad59db2c930c85cdc0a6a37ecc8f344e2c
SHA2564ae86843fbb76c8a9bc3c364f85ec8ec1727556970e7ed5c2d31868e631c3162
SHA512799b561f54f841eed856ccebefc9cac90000837afa677f3718e550aa8f0c445e77a37f2eb69c8ec25f734fe64ff63cf7352f6c2ee8f9bb7efc90244582ab3788
-
Filesize
205KB
MD5dee52c28fb4198cc702f3c379c5e982b
SHA1bb8f5c9f2ddadf3544a6319e66f5a6dd6788decf
SHA256e005bc8003ca90903f021df51c9af6d35b750e67799ecbabed0af71ba54a4231
SHA5120a76e229299f4c799b007cc43723a29fe6306fea9db07a43dab216fa73b952dc0d2a45e3de8267d94203e77a2712574a65bf29a6e322f9f2fd65cf4006d8c838
-
Filesize
1.1MB
MD5341d01d2cb848e096a4f4c6d09cf1957
SHA1d66940670eafe5b10f9c3bf2cdead8506fac815e
SHA256cb662b012f9230ce4ba6d545d215c133354fd5a747d12541b4653ab70fec0cfe
SHA512ac937982ba65073b6cfe7e30d26cacb69e64edfdfaecb7b1dc50fcec8e5be27ada7b90300477edd4a85e57bc24762101e20f6c5418ce5cdbf1183d8764413b8c
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
240KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
240KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
4KB