eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801

General

Target

eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
Size

1.2MB
MD5

6e667db54814bbf9cde7c00a1f9ccaad
SHA1

a2feadc2e292c60436f63cdc17a7a61ed78b9859
SHA256

eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801
SHA512

c77f5395a188feae436ac88d675d215d220bbd0fdd659522d99140c5add8edfa17f8447ce8f56f17ff22f51a2aac21ca393c01b8c46093c1c5080f9f4f3427ba

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe

pid	process
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe

pid process

516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe

pid process

516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe

pid process

516 eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe

description	pid	process	target process
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe
PID 516 wrote to memory of 1980	516	eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe
"C:\Users\Admin\AppData\Local\Temp\eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

1

T1090

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Connection Proxy

1

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/516-114-0x00007FF84BB70000-0x00007FF84BD4B000-memory.dmp

Filesize
1.9MB

Download
memory/1980-115-0x0000000000000000-mapping.dmp

Download
memory/1980-116-0x0000000076FF9000-0x0000000076FFA000-memory.dmp

Filesize
4KB

Download
memory/1980-120-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download

Resubmissions

Analysis

Sharing