Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
31/08/2024, 21:56
General
-
Target
d292e7388d4cd59fc1fc5efe2e933e453bbbe53a29503a5c6447849afd6f3c09.exe
-
Size
1.2MB
-
MD5
4689527f10d148468069ee575d34716c
-
SHA1
c4e6fb7495ce9fc80ff9304d8976e4c0e02506dc
-
SHA256
d292e7388d4cd59fc1fc5efe2e933e453bbbe53a29503a5c6447849afd6f3c09
-
SHA512
492526d830cbe3c2cf399722a314f93096cc2f0cb17f0cd9be871660efba29777bca6d48e08ddbfea44705d1d557b2bdfcbd8adfcd5b9d5c444f0235ad671c15
-
SSDEEP
24576:yzd9Sm6s3SB4VbhzGcHb0bBhXxtyesOlU0YOTAXnA91IV7HExDaIu:yzTSmvdcwb0VhXHlrTKA91IV7HExOIu
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d292e7388d4cd59fc1fc5efe2e933e453bbbe53a29503a5c6447849afd6f3c09.exe"C:\Users\Admin\AppData\Local\Temp\d292e7388d4cd59fc1fc5efe2e933e453bbbe53a29503a5c6447849afd6f3c09.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
324KB
MD542b6ce8bb3ad66d7f3e0863d22608c35
SHA19deee3167fa2f489318f531319992b2be354f164
SHA256c32e10b9ef6de348421b6842bfce8991557f8d2e3cd2c09a0c1012e731cadbea
SHA51275bfedc8e5b6ec769900fff64b0a0453d8b9a23ba851bb2c1dda0a0c84d78d63b1b8d6fbb42f7ca3a84b604952e58ca4767bb28e3d6d98566894cb920d6bb8c7
-
Filesize
22B
MD5abd17ef824779795ac935e2705f3b907
SHA175f1e12aecb5876b5b04a4d4628b73d40af0154b
SHA256aa646b15b5fb4b4a3662d29a4fff207d4463a4d99117db3afb66c297369d9517
SHA512535ca304ed9e02309d7f38a0efa4c56ff88f7871424f50291a5f5fa4984a2911b0e80878b62e821f9dee17b01e1c64fb84292f2ae8d54930d4b2312abee749a8