Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
24-05-2024 11:59
General
-
Target
8a424618cfe9e24fe842ba97bd176c82070e9ecf58ff368fda1a2ccce29caab9.exe
-
Size
5.6MB
-
MD5
920fe71d02f71520fd8f6f54586638db
-
SHA1
5b0c4d42c90332cf3e936ed04740206a93557b41
-
SHA256
8a424618cfe9e24fe842ba97bd176c82070e9ecf58ff368fda1a2ccce29caab9
-
SHA512
91402cae6e8d531e1b3bfc2053d2e24f9054d2545fa3b494e02bef1db9ba401cb913058407a8ea90e615b96de8da2273f5c635351e9a6366889be75143b39c34
-
SSDEEP
98304:Mrbc0dxOfbCIYflBduQn8m1tB9wkakcAGbXh2Js2Uu/LKWM5Y8I:MrbcQWb8flBdm+79wEcAZaOzKWgI
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a424618cfe9e24fe842ba97bd176c82070e9ecf58ff368fda1a2ccce29caab9.exe"C:\Users\Admin\AppData\Local\Temp\8a424618cfe9e24fe842ba97bd176c82070e9ecf58ff368fda1a2ccce29caab9.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576KB
MD57bc18b5d04bbaa53af22bb288c5a810c
SHA16e3ba5d7c21a38076bcad960f51c8849928a0c9a
SHA256ce7c04f57eae835917279c44c64c790370d26a69311d8ca501d8ddd6670649b4
SHA512d6bca1619cc028a74e68d8188986e5d13749fd336c2ce9498dba8937142369ce6ca61d1d8df8e283b8f2f1b5e125a227a3a720950c7d3b585c24e5871cb99963
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
2.0MB
-
Filesize
6.6MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
7.1MB
-
Filesize
6.6MB
-
Filesize
7.1MB
-
Filesize
2.0MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
4KB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
6.6MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
6.6MB
-
Filesize
7.1MB
-
Filesize
6.6MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB