ebf29f6e0d7487301d2670db3686b07bfbb4a7cce0ea022ac03cac9d16deeb78

Analysis

Target

6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe
Size

1.9MB
MD5

5343e92d267c2afec4f27377cd95449a
SHA1

111277ed4286124854b781210a4e78b64e86288d
SHA256

6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524
SHA512

0a1ddc8ee8600443a7320513d00591173bfd40d6c538f585da84f6807499e04beef6f31a8ad01d5c8cebd67f60b084407ce563a00f9afdd42d37fd873b2f0e4f

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe

pid	process
1768	6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe
1768	6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe
1768	6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe
1768	6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe
1768	6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe
1768	6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe
1768	6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe

C:\Users\Admin\AppData\Local\Temp\6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe
"C:\Users\Admin\AppData\Local\Temp\6d9db6ba26b1730bf6910456b4a6c25821ddbfe8542bea456a3bbb924ea83524.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/1768-60-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download