29013124da3e662c2662e856b7ef9527fb367ecd1be8aaba412eeb8a6d738a6c

Analysis

Target
4d1405bb4596a6f600c49b64d8a09892.exe
Size 2.3MB
Sample220107-a9skxacbdj
SHA256 29013124da3e662c2662e856b7ef9527fb367ecd1be8aaba412eeb8a6d738a6c
MD5 4d1405bb4596a6f600c49b64d8a09892
SHA1 51fddcc1efd8e7f4898d28f669abf6c03f9737a5
SHA512 0dad12c995294855382485ac019e1ee6b115cba83f0023458307b9cea260c69ba5348c187d29695c1165db95d36b4688dad112346f7b0b49063da677367f1cdf
MD5 SHA1 SHA512

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	4d1405bb4596a6f600c49b64d8a09892.exe
2740	4d1405bb4596a6f600c49b64d8a09892.exe

C:\Users\Admin\AppData\Local\Temp\4d1405bb4596a6f600c49b64d8a09892.exe
"C:\Users\Admin\AppData\Local\Temp\4d1405bb4596a6f600c49b64d8a09892.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact