ebf29f6e0d7487301d2670db3686b07bfbb4a7cce0ea022ac03cac9d16deeb78

Analysis

Target

a798b09ca056657bb97434edf659394d.exe
Size

1.9MB
MD5

a798b09ca056657bb97434edf659394d
SHA1

143280fa164815f73c3c89687e3711f3a3128596
SHA256

2ff619a4b0c109117b73ec22b00cbbbf1c09fe1d8fcedffb4929d07600ad2dbe
SHA512

b8c5928f68aff230547c9b3b39d511cca4a30649b792dcd74ba8bfaff8ddf635c571a7d9396a0a75f930fb08fccd3a96ef24c86df11e56d66f90780ce35b0069

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

a798b09ca056657bb97434edf659394d.exe

C:\Users\Admin\AppData\Local\Temp\a798b09ca056657bb97434edf659394d.exe
"C:\Users\Admin\AppData\Local\Temp\a798b09ca056657bb97434edf659394d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:584

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact