Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 19:57
Behavioral task
behavioral1
Sample
cc44408a246bbc5b45cd281345bee040N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
cc44408a246bbc5b45cd281345bee040N.exe
-
Size
216KB
-
MD5
cc44408a246bbc5b45cd281345bee040
-
SHA1
5ff993ece002c8b346df5e0bdd6cdf085f3f32a2
-
SHA256
c5d99ccfa935473bd41726dafeae1ec205ea7f2b6ad172e60e61bd18c1dc79e0
-
SHA512
55915ecec31501493e5a29748e536fd5e1262541754b02c779d1e8c14a32617b532b9643485225c9b799a0cc84605fa504d79034951c648957a92b9d0c46cb3a
-
SSDEEP
6144:9TqPR5dIKCCkef//uXl9Kc+LVsz9b8yYU:sdFOCXu7KcCVsz6yYU
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2680-4-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2680-2-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2680-5-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2680-6-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2680-7-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2680-10-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1628 set thread context of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cc44408a246bbc5b45cd281345bee040N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cc44408a246bbc5b45cd281345bee040N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1628 cc44408a246bbc5b45cd281345bee040N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30 PID 1628 wrote to memory of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30 PID 1628 wrote to memory of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30 PID 1628 wrote to memory of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30 PID 1628 wrote to memory of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30 PID 1628 wrote to memory of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30 PID 1628 wrote to memory of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30 PID 1628 wrote to memory of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30 PID 1628 wrote to memory of 2680 1628 cc44408a246bbc5b45cd281345bee040N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc44408a246bbc5b45cd281345bee040N.exe"C:\Users\Admin\AppData\Local\Temp\cc44408a246bbc5b45cd281345bee040N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\cc44408a246bbc5b45cd281345bee040N.exe/scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"2⤵
- System Location Discovery: System Language Discovery
PID:2680
-