Analysis
-
max time kernel
93s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18-04-2024 07:55
General
-
Target
tmp.exe
-
Size
688KB
-
MD5
8ffd1d5dc217434f47b2b11ba08fe886
-
SHA1
e0a6086d02b8bd41e7a5e9319210d4f9f727bb95
-
SHA256
4ea27b4553fd2225c3782ee64d8740beddff3e858c55db5ad836144ad92fc80d
-
SHA512
90b3f43dc2b36263ad1140ac9e1862c86c035fd13038ded9f6991a94b54291ed455c73528e47d98351e1d9fef6074f671d8b8bf917befc9bdf3e4dbd6f4da253
-
SSDEEP
12288:XdPJBWYUgp7snf8LvdEpF+M568KXEgO9+0i:XtJEYTp7m87epFdKXHO9+0i
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx