Analysis
-
max time kernel
104s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
30/03/2025, 16:01
General
-
Target
.exe
-
Size
6.4MB
-
MD5
b65bbb59533176ff10083328ddaa18c7
-
SHA1
9f870ba135c4244db068c0bff7f875e904e535f0
-
SHA256
e0decd5e242a276ca03092e53e28f0a5d01741bfa3ba33170f1e7fa417b35618
-
SHA512
8dcab4b6dccb736f1bd55b3406b1598efa37e90153c71fb896755df9d65cde27ffcb7f01d2ee47edf572cd1cf36945d92050fe437a663649393e4294a4d18766
-
SSDEEP
98304:rQTzteK9NvJiP2Zje8tNJj669cERHEkN+nCFAD7aSwIfeaG4u6r:M/te2vJiP288tUdkSCFADOQe56r
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
4KB
-
Filesize
6.2MB
-
Filesize
4KB