Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-01-2025 08:49
General
-
Target
57f8e4e1d3339c0abadc0f64fc6a4abaff19cd138724cdbb3fae5f37905547c5.exe
-
Size
248KB
-
MD5
690387324dc7c8704a9430cdabf22a7a
-
SHA1
3d20c1f2f551dba4712f6dda43e87dd6cd32422b
-
SHA256
57f8e4e1d3339c0abadc0f64fc6a4abaff19cd138724cdbb3fae5f37905547c5
-
SHA512
9b44d2fee5fdb86dd3cd7a4aac74e6f984c4673130ad404c1ac22d58cb792f55ff1840264323bd27704bfaf9b0c32edb1db32a11d0cec03f965d97e180979605
-
SSDEEP
6144:OaE1NFRBAaSMMuYPiBjlC3EkNdBbp247hZFM:sYanMXKBd2UO2
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\57f8e4e1d3339c0abadc0f64fc6a4abaff19cd138724cdbb3fae5f37905547c5.exe"C:\Users\Admin\AppData\Local\Temp\57f8e4e1d3339c0abadc0f64fc6a4abaff19cd138724cdbb3fae5f37905547c5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
580KB
-
Filesize
580KB