Analysis
-
max time kernel
68s -
max time network
51s -
platform
windows11-21h2_x64 -
resource
win11-20250610-en -
resource tags
arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/07/2025, 05:55
Static task
static1
Behavioral task
behavioral1
Sample
193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe
Resource
win10v2004-20250619-en
General
-
Target
193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe
-
Size
1.2MB
-
MD5
0c9bff791e90c7cb763a37d4d70bdbe8
-
SHA1
5f8b38f79bbfcf7f73029a9f02956076b253151a
-
SHA256
193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e
-
SHA512
25623c33013b34913fad90b1ccc3da4a4574e1c63e09a36fc4eccf1f807ddc154028063b14f07aa645af596ed7243cdce67ab8a53fa3372bce7b705af9b7fb91
-
SSDEEP
24576:XBg0PW0OazYUAbDozzr+JeVrxMDqnEyLVpjG:XB4aubDQ+ArxQy2
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4808-0-0x0000000010000000-0x00000000100BC000-memory.dmp upx behavioral2/memory/4808-4-0x0000000010000000-0x00000000100BC000-memory.dmp upx behavioral2/memory/4808-2-0x0000000010000000-0x00000000100BC000-memory.dmp upx behavioral2/memory/4808-3-0x0000000010000000-0x00000000100BC000-memory.dmp upx behavioral2/memory/4808-6-0x0000000010000000-0x00000000100BC000-memory.dmp upx behavioral2/memory/4808-7-0x0000000010000000-0x00000000100BC000-memory.dmp upx behavioral2/memory/4808-16-0x0000000010000000-0x00000000100BC000-memory.dmp upx behavioral2/memory/4808-25-0x0000000010000000-0x00000000100BC000-memory.dmp upx behavioral2/memory/4808-26-0x0000000010000000-0x00000000100BC000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4808 193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe 4808 193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe 4808 193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe 4808 193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe 4808 193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe 4808 193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4808 193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe 4808 193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe"C:\Users\Admin\AppData\Local\Temp\193ca4c819db1e0d63ecfe3efee5156f5b58d195c3af1cc7eb0159cb6dcae41e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4808