Analysis
- max time kernel
103s - max time network
125s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
02/10/2025, 06:09
Behavioral task
behavioral1
Sample
31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0.exe
Resource
win10v2004-20250619-en
5 signatures
150 seconds
General
- Target 31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0.exe
- Size 1.4MB
- Sample251002-gwrvsaxybw
- SHA256 31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0
- MD5 2e619fbf9ae1040838fe4933dfe757c6
- SHA1 7c5482e43bbd167d1e7f38f173e2bdf0a525cb5f
- SHA512 dba3eb8ad39e7d25b9fbea472cc6badb7479577b282453ce4f670090bbe9641c7bd6bf986a727a92969ab66534a9a06807e32a817c5560b3d6f710de36b19533
- SSDEEP 24576:Wxu/UPTv4iGd5FprVueuqSTzLEAONA+WxCpZlE0S0ppgZ63nIn/INuYQ0x2222v+:x/CQiGkeubLp+A+WxCpZlEoy63nIn/I6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Acreed family
- Detects Acreed Stealer 3 IoCs
resource yara_rule behavioral2/memory/4668-0-0x00000000003D0000-0x0000000000543000-memory.dmp family_acreed behavioral2/memory/4668-26-0x00000000003D0000-0x0000000000543000-memory.dmp family_acreed behavioral2/memory/4668-29-0x00000000003D0000-0x0000000000543000-memory.dmp family_acreed - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\AppState.json
- Size 612B
- SHA256 d22e33d806b0cda914a89c2ab57bd0166e4bac7e70896f5b5782e63881e09063
- MD5 0c5756acc918a8fd1b4ecc46b32e9f7f
- SHA1 938a07e3e13d80e3a3511e4f8e9910877180843d
- SHA512 5d4d78c836c177fa6e6c61ea12a775479ed8653a65260e4e2fe88d88c0482846c0c6a0102e23de4bf7ea4a0aea276fb6feff709a77de78a44d93d7a681aa0c5c
- MD5 SHA1 SHA512