Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-08-2024 10:09
General
-
Target
7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356.exe
-
Size
901KB
-
MD5
36c1f4bde9faa23abacb87a2d090ce77
-
SHA1
db53a9d930e8bc480e1e1b10abbf1fab158814c7
-
SHA256
7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356
-
SHA512
99034156dea9a2881a9eabd05732087f197128ad0008fe3bfeaedfdb9d91867e78b71255d7bc3c9ef0d90d4c72bd7ac8ab0f68a0c81eb7d752b40c48c6c6f42a
-
SSDEEP
24576:VrpRrJq00ihAcWgudeIPDMJD0n5xs70ivjt:1pRrJqNihA4XD0n5GQiv
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356.exe"C:\Users\Admin\AppData\Local\Temp\7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path