d11866e458626e81d4aa4bd9fdb441bec5a684ccaf7b786acddb95377d66b72f

Resubmissions

28-10-2020 11:13

28-10-2020 00:25

Target

fltMC7e0.exe
Size

976KB
MD5

30d365051e1c8ef9a84843ac9b10998f
SHA1

4a01901391b9899b9d07ccff4f8c4521d4644faa
SHA256

d11866e458626e81d4aa4bd9fdb441bec5a684ccaf7b786acddb95377d66b72f
SHA512

8b5a4b88943bd3920fe0ab84369f1e1577a10c869c5c8ebf78e54e84352828adf3326fb368ce6ac9915939712e912ac400bfa750ad05b13f22fb5020ab125829

Score

7^/10

spyware

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 4088 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fltMC7e0.exe

pid process

1792 fltMC7e0.exe
1792 fltMC7e0.exe

description	pid	process
Token: SeDebugPrivilege	4088	wermgr.exe

pid	process
1792	fltMC7e0.exe
1792	fltMC7e0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fltMC7e0.exe

description	pid	process	target process
PID 1792 wrote to memory of 4088	1792	fltMC7e0.exe	wermgr.exe
PID 1792 wrote to memory of 4088	1792	fltMC7e0.exe	wermgr.exe
PID 1792 wrote to memory of 4088	1792	fltMC7e0.exe	wermgr.exe
PID 1792 wrote to memory of 4088	1792	fltMC7e0.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\fltMC7e0.exe
"C:\Users\Admin\AppData\Local\Temp\fltMC7e0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4088

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1792-3-0x0000000003410000-0x000000000344B000-memory.dmp

Filesize
236KB

Download
memory/4088-4-0x0000000000000000-mapping.dmp

Download