875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0

General

Target

875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe
Size

2.1MB
MD5

7d805076b1ccffc8a34ca42506dd9a57
SHA1

816cb3593b34dd3767b42127fa7c3b4fe76b900d
SHA256

875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0
SHA512

8de78ae65b1838fa88de346809c3c88f0944cdd866f48f8bfe580225b55a0f06b430c5da47c0e754fb926bc02f8fa3732670ecb2586b4d4647a9c36b53a0d51d

Score

7^/10

spyware

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe

description pid process

Token: SeDebugPrivilege 744 875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe

description	pid	process
Token: SeDebugPrivilege	744	875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe

C:\Users\Admin\AppData\Local\Temp\875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe
"C:\Users\Admin\AppData\Local\Temp\875972c6043bdc3ac7cc51ac8f7ae58a43b43fcfc933672caa9a0f92f27825c0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-2-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/744-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/744-5-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/744-6-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/744-7-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/744-8-0x0000000004E20000-0x0000000004E73000-memory.dmp

Filesize
332KB

Download
memory/744-9-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/744-10-0x0000000004F20000-0x0000000004F71000-memory.dmp

Filesize
324KB

Download
memory/744-11-0x0000000004F80000-0x0000000004FCC000-memory.dmp

Filesize
304KB

Download
memory/744-12-0x0000000004FD0000-0x000000000501A000-memory.dmp

Filesize
296KB

Download
memory/744-13-0x0000000005030000-0x0000000005078000-memory.dmp

Filesize
288KB

Download
memory/744-14-0x0000000005080000-0x00000000050C5000-memory.dmp

Filesize
276KB

Download
memory/744-15-0x00000000050D0000-0x0000000005112000-memory.dmp

Filesize
264KB

Download
memory/744-16-0x0000000005120000-0x000000000515F000-memory.dmp

Filesize
252KB

Download
memory/744-17-0x00000000053B0000-0x00000000053EA000-memory.dmp

Filesize
232KB

Download
memory/744-18-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/744-19-0x0000000005430000-0x0000000005463000-memory.dmp

Filesize
204KB

Download
memory/744-20-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Filesize
4KB

Download
memory/744-21-0x0000000005D40000-0x0000000005D41000-memory.dmp

Filesize
4KB

Download
memory/744-22-0x0000000005B70000-0x0000000005B71000-memory.dmp

Filesize
4KB

Download
memory/744-23-0x0000000008080000-0x0000000008081000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing