Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 01:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe
Resource
win7-20240508-en
3 signatures
150 seconds
General
-
Target
41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe
-
Size
2.4MB
-
MD5
d961b76024edf043b709ae146a38a4c7
-
SHA1
e520a1872769d35e045fba592f7987eb97e6f175
-
SHA256
41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d
-
SHA512
3b489b80d2f66920872ceec58907ac05b3283bf95bc19a4268c8ff86b0a22ae085d602a8573c09c3cf19d640388d27b0198d72e804c8c727333352d42f17beec
-
SSDEEP
49152:ixg6k7wKl7hD3KwVD23iA1Vt5//6+b7FA55b1xiJOtieykm87eJJB1bsjbJ1TD:IFk7wKdhbj2ttN6+A5beCm8iJOZBD
Malware Config
Extracted
Family
stealc
Botnet
jony
C2
http://85.28.47.4
Attributes
-
url_path
/920475a59bac849d.php
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exepid Process 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exepid Process 2184 41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe"C:\Users\Admin\AppData\Local\Temp\41312792dcc936995c9e6c4b645482195a80d021ec58837971068afb6416b44d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2184