Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2025 06:44
Behavioral task
behavioral1
Sample
5da4312ba1deeb7da82f8ceb4053166169df335206385f6cbe08865b390bef90.exe
Resource
win7-20240903-en
General
-
Target
5da4312ba1deeb7da82f8ceb4053166169df335206385f6cbe08865b390bef90.exe
-
Size
228KB
-
MD5
f8c0964a3ce7b66412b7eb05b513725a
-
SHA1
4750395496b456f69bd4902ba7080c639a27131c
-
SHA256
5da4312ba1deeb7da82f8ceb4053166169df335206385f6cbe08865b390bef90
-
SHA512
be6b4792bd158a4bd2c1c87c0e1404a23fda471f7db5882006b9d3f524c177eed70248cf7ed1b32cf2a7b2f582327756366cf62b41ae12e63b684408b9a9ae7a
-
SSDEEP
6144:tsaB3U8GoteSJrJ8iZf3uyQ4JF4WI+IicjXxvzKKWog:F1jlteSJF9Q4D4WI+IicLBOKWog
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3208-0-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-4-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-5-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-6-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-7-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-8-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-9-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-10-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-11-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-12-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-13-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-14-0x0000000000400000-0x0000000000483000-memory.dmp upx behavioral2/memory/3208-15-0x0000000000400000-0x0000000000483000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5da4312ba1deeb7da82f8ceb4053166169df335206385f6cbe08865b390bef90.exe