Analysis
-
max time kernel
131s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 04:34
General
-
Target
fe4ca7d7b713dd306597e33a8dd686706843542911fea4ef54941857b10219c1.exe
-
Size
2.3MB
-
MD5
f9076703321c6e3e292f0955d3e56dbd
-
SHA1
a199a764dfd00c768d5a26f8250b0d5cb24df9c1
-
SHA256
fe4ca7d7b713dd306597e33a8dd686706843542911fea4ef54941857b10219c1
-
SHA512
432ebb7ecef50e4ae6ca98a9b3e3f36b6d1879db20cd67cce1e1e588e0a43d7331d0f31118cbb49ab2ca74f527dd4e6c26216043be9657b1c46cd0dd3a07d1bc
-
SSDEEP
3072:0f8nGHElvZZT+4qXcHvuefUbgtvfYtgJErjCBUvkUT/HTNN:08nFlvCxBX2XYKujUALrTNN
Malware Config
Signatures
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fe4ca7d7b713dd306597e33a8dd686706843542911fea4ef54941857b10219c1.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fe4ca7d7b713dd306597e33a8dd686706843542911fea4ef54941857b10219c1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fe4ca7d7b713dd306597e33a8dd686706843542911fea4ef54941857b10219c1.exepid process 1568 fe4ca7d7b713dd306597e33a8dd686706843542911fea4ef54941857b10219c1.exe 1568 fe4ca7d7b713dd306597e33a8dd686706843542911fea4ef54941857b10219c1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe4ca7d7b713dd306597e33a8dd686706843542911fea4ef54941857b10219c1.exe"C:\Users\Admin\AppData\Local\Temp\fe4ca7d7b713dd306597e33a8dd686706843542911fea4ef54941857b10219c1.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1568-9-0x0000000028320000-0x000000002857F000-memory.dmpFilesize
2.4MB