Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
27/02/2025, 06:50
General
-
Target
3120-1347-0x0000000000400000-0x0000000000459000-memory.exe
-
Size
356KB
-
MD5
bb12aac9fdd1a898bc05827e2867067f
-
SHA1
f751b89cd279d1dcab50412fb762bb8e9cb0cf03
-
SHA256
da25603a4f0814e69588e90d66544d0a5287eb8460f4bf2967aa2f3ef5c1059f
-
SHA512
c9591f6c70f713e12e505d6d93a24c7362f6e106f298fb8e8e063501fa4f2698212951a7333cb69665c71a4f2525f752a8457cef97eb8a67a40622f663d3ad02
-
SSDEEP
6144:OHJ8d1/w5KA81IJ8GpF6nuTmOOUpAhhW+fekiUmrHVAyfvSkj9qJu:OyjYKkJj6GmZUpghW+oUmBAyfKosJ
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3120-1347-0x0000000000400000-0x0000000000459000-memory.exe"C:\Users\Admin\AppData\Local\Temp\3120-1347-0x0000000000400000-0x0000000000459000-memory.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx