ebf29f6e0d7487301d2670db3686b07bfbb4a7cce0ea022ac03cac9d16deeb78

Analysis

Target

b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe
Size

2.8MB
MD5

dcef36616a7b5c2be007d9f47b00d91d
SHA1

2ebbf52f7b7fc44578a2cb34bb04f80bbd3a0229
SHA256

b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734
SHA512

9a164d9a7cfad239041ed15fb601dfb13acc0ae2bbccd446bfb3bb1250b5d38bce8e0c037dc26740d92f3c1ee1ebcdc7144f89ae76242898015640f1a76446b2

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe

pid	process
296	b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe
296	b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe
296	b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe
296	b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe
296	b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe
296	b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe
296	b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe

C:\Users\Admin\AppData\Local\Temp\b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe
"C:\Users\Admin\AppData\Local\Temp\b4556fe3a65fd59deebb705c66424a50a07ac077bcff31cae040ea2f5a4f0734.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:296

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/296-60-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download