47a5f7afd13add11abcc9b3d65a75af6c9eb6aef2d778a135da57a7282fabf7e

Analysis

Target
893d98763ce6880b1e570cca1e746f84.exe
Size 6.6MB
Sample210223-aqbb8e792e
SHA256 47a5f7afd13add11abcc9b3d65a75af6c9eb6aef2d778a135da57a7282fabf7e
MD5 893d98763ce6880b1e570cca1e746f84
SHA1 02a44c85cb566e677f3a46a975594b2f75f775bb
SHA512 e14c4e2076a19bf44ab67f550b284313c87e598276a3d506449a0d31af3eebfd2efdb9b490a750e1bb4b09ad24cc5f2f84901d914cab10fc66fffebe488ac782
MD5 SHA1 SHA512

Score

7^/10

spyware

Loads dropped DLL 13 IoCs

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4868	4708	893d98763ce6880b1e570cca1e746f84.exe	70
PID 4708 wrote to memory of 4868	4708	893d98763ce6880b1e570cca1e746f84.exe	70

C:\Users\Admin\AppData\Local\Temp\893d98763ce6880b1e570cca1e746f84.exe
"C:\Users\Admin\AppData\Local\Temp\893d98763ce6880b1e570cca1e746f84.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\893d98763ce6880b1e570cca1e746f84.exe
  "C:\Users\Admin\AppData\Local\Temp\893d98763ce6880b1e570cca1e746f84.exe"
  2⤵
  - Loads dropped DLL
  PID:4868

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact