15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85

Analysis

Target

15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85.exe
Size

235KB
MD5

897385950aad28169556fb8d37b06773
SHA1

3044fd2031c822289cae1cb69ab7bd2efc174d44
SHA256

15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85
SHA512

835c0612165d4a10348e24cfbbf5d111058fa73c6c112729c6a9e638f5c9d674e4dddac7c1b68e983182ba213c5eb4bbbae98efb90efe901cce4c597b14dcc4c

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2528 timeout.exe

pid	process
2528	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85.execmd.exe

description	pid	process	target process
PID 636 wrote to memory of 416	636	15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85.exe	cmd.exe
PID 636 wrote to memory of 416	636	15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85.exe	cmd.exe
PID 636 wrote to memory of 416	636	15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85.exe	cmd.exe
PID 416 wrote to memory of 2528	416	cmd.exe	timeout.exe
PID 416 wrote to memory of 2528	416	cmd.exe	timeout.exe
PID 416 wrote to memory of 2528	416	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85.exe
"C:\Users\Admin\AppData\Local\Temp\15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\cmd.exe
/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\15877d60d725b49ea79fb8f0341a2b70c795192eba709d0c60b8288394903d85.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:416

C:\Windows\SysWOW64\timeout.exe
timeout /t 3
3⤵
- Delays execution with timeout.exe
PID:2528

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/416-2-0x0000000000000000-mapping.dmp

Download
memory/636-0-0x0000000000906000-0x0000000000907000-memory.dmp

Filesize
4KB

Download
memory/636-1-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/2528-3-0x0000000000000000-mapping.dmp

Download