3a16c941223ae24e33b62e925575669a52f7993765aadf075a8bea5decd8a836

Analysis

Target

7zS850A099E/61e7501b7eabe_Tue2344597f.exe
Size

527KB
MD5

8e0bc14c20fd607593967f164bbf08b5
SHA1

f68dc21b6352302d36cb1953ac0065e30d1ca6b0
SHA256

af8fbb1b23a21d1be75abcbb8d7c8447ec0c3b309fcfb407a91576a06070dcfe
SHA512

71cb5f5cfc5bb858a3ec2b7cf94d1d0652b5b66c505c4016c9d86e19ba86352d5f8f332df11be163c4aa1d3d36fc892bcc5bd5f2fbd6a383cd4e36c9885c7639

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

61e7501b7eabe_Tue2344597f.exe

description pid process target process

PID 1672 set thread context of 732 1672 61e7501b7eabe_Tue2344597f.exe 61e7501b7eabe_Tue2344597f.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

61e7501b7eabe_Tue2344597f.exe

pid process

732 61e7501b7eabe_Tue2344597f.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

61e7501b7eabe_Tue2344597f.exe61e7501b7eabe_Tue2344597f.exe

description pid process

Token: SeDebugPrivilege 1672 61e7501b7eabe_Tue2344597f.exe
Token: SeDebugPrivilege 732 61e7501b7eabe_Tue2344597f.exe

description	pid	process	target process
PID 1672 set thread context of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe

pid	process
732	61e7501b7eabe_Tue2344597f.exe

description	pid	process
Token: SeDebugPrivilege	1672	61e7501b7eabe_Tue2344597f.exe
Token: SeDebugPrivilege	732	61e7501b7eabe_Tue2344597f.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

61e7501b7eabe_Tue2344597f.exe

description	pid	process	target process
PID 1672 wrote to memory of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe
PID 1672 wrote to memory of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe
PID 1672 wrote to memory of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe
PID 1672 wrote to memory of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe
PID 1672 wrote to memory of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe
PID 1672 wrote to memory of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe
PID 1672 wrote to memory of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe
PID 1672 wrote to memory of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe
PID 1672 wrote to memory of 732	1672	61e7501b7eabe_Tue2344597f.exe	61e7501b7eabe_Tue2344597f.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/732-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/732-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/732-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/732-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/732-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/732-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/732-65-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/1672-55-0x0000000000A70000-0x0000000000AFA000-memory.dmp

Filesize
552KB

Download
memory/1672-57-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1672-56-0x00000000004D0000-0x0000000000577000-memory.dmp

Filesize
668KB

Download
memory/1672-58-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download