ca0abe0d1554af3cbfcf5ee2a0dd00820a0dcb7397ea7add4c2c5334baac9086

Analysis

Target
fbc2034c0a74ca43319ebeddbc80db75.exe
Size 2.3MB
Sample220106-zbvp2scacm
SHA256 ca0abe0d1554af3cbfcf5ee2a0dd00820a0dcb7397ea7add4c2c5334baac9086
MD5 fbc2034c0a74ca43319ebeddbc80db75
SHA1 4a663cf3dca9bff4f0b745ea707fb4eb1120a198
SHA512 7ab69f766ad46a33bfa8f9e1fb2f4cbf60e68dc799a1ab99d6aff4d40d1b339f364318e3dabd8bbd154402933688b30828625fee5670542f875b0c97332b8090
MD5 SHA1 SHA512

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2140	fbc2034c0a74ca43319ebeddbc80db75.exe
2140	fbc2034c0a74ca43319ebeddbc80db75.exe

C:\Users\Admin\AppData\Local\Temp\fbc2034c0a74ca43319ebeddbc80db75.exe
"C:\Users\Admin\AppData\Local\Temp\fbc2034c0a74ca43319ebeddbc80db75.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact