55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560d

Analysis

max time kernel
16s
max time network
33s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560dN.exe
Size

933KB
MD5

e5f75720b5d5547e154c6ebdc910d950
SHA1

1b21988217cab3dd0de2b6880b3e3817d4cff35e
SHA256

55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560d
SHA512

0199fbf96ed11085936bed679f833fb556f970a5dd53e6d968b53ce1bc414269b33de05093b2c1e6d0e79165057898053abd54f4990946b40e7a7a9cf7e8e3a0
SSDEEP

24576:Xfi9TwnWsQgFWIgzeZpf5HocFohEV1FhJdTNye+AcuCcScw:NWDzeZLocFohEV1FFTIeouQ

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560dN.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2452	55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560dN.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2452	55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560dN.exe
2452	55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560dN.exe
2452	55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560dN.exe
2452	55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560dN.exe

C:\Users\Admin\AppData\Local\Temp\55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560dN.exe
"C:\Users\Admin\AppData\Local\Temp\55be937c85aacddc8ca4d0ac7e1949e1bea6af1ff67a9944138ad98bc15f560dN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bottom.jpg

Filesize
1KB

MD5
2a02f5cfb8ab6ef8da96cb6319199ec1

SHA1
e835817901cae81eb1a88cd76b08dc00b2e27111

SHA256
24f374f557014d78b3a19a6595caabedc7e9c496bcbfca3a84f0f4ff17196225

SHA512
05313d9c0d5af986f90c3b000074037bf8399fa5d9a29b8e7c9093dd748fb8ea8d66e51d443e0a8c2aa908f59e37d6ddc49b2f62141d15cc4f1fad1aa897fa3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\header.jpg

Filesize
3KB

MD5
1fffd38bcbcddd52c8f171812c897e14

SHA1
753f8226acab4970537358973d3aa9cff789617a

SHA256
e065105abe1d41c492e6097958e497cbf120589122d15c04a0791c30f63a770f

SHA512
b092d5e2ca6623a2875b8e9005a27c189cc2ac6cdf7815f4da179d253ac0419a7ae16e96f9357b09655b843d9d71842a94d9faa62415d74df3b2bc0b643e7a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\side.jpg

Filesize
27KB

MD5
60f34e6b09d2244e5576131dc91e1631

SHA1
144183bb0d4de6ced00d2c0c0fe32bb51f744fe6

SHA256
317ccb762831c8cd4e64e45a5368ab53e34eb64b0fc09fb6cf68ddde97119c1a

SHA512
b544b05e8486e8faa581a7874a7084ed7331e499b8c68110ff2b816516c62c10b87afc01d5e782b9e534c3f209a738e13d75b94c81426830a93b6f2c18b357cd

Download Submit