3a16c941223ae24e33b62e925575669a52f7993765aadf075a8bea5decd8a836

Analysis

Target

7zS850A099E/61e7501c830d6_Tue23bdf4712a32.exe
Size

523KB
MD5

c7f26d8e0ac6d899d6febd75f81f9cc3
SHA1

113fe52d0562fa3b591dffd633f0d3d6db4feee8
SHA256

762433792d60c6c384fca690a8b3b5ef9e2390fd18ad0abdec248229bd5d89bc
SHA512

6848bff0d6e6302598faf274e35cb46c5b076937098a15558a199fded52d65a6486a4ae7cb9f756ea01c5fe4a685759bb6d1bf60fcf794528548830683aaee64

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

61e7501c830d6_Tue23bdf4712a32.exe

description pid process target process

PID 1664 set thread context of 872 1664 61e7501c830d6_Tue23bdf4712a32.exe 61e7501c830d6_Tue23bdf4712a32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

61e7501c830d6_Tue23bdf4712a32.exe

pid process

872 61e7501c830d6_Tue23bdf4712a32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

61e7501c830d6_Tue23bdf4712a32.exe61e7501c830d6_Tue23bdf4712a32.exe

description pid process

Token: SeDebugPrivilege 1664 61e7501c830d6_Tue23bdf4712a32.exe
Token: SeDebugPrivilege 872 61e7501c830d6_Tue23bdf4712a32.exe

description	pid	process	target process
PID 1664 set thread context of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe

pid	process
872	61e7501c830d6_Tue23bdf4712a32.exe

description	pid	process
Token: SeDebugPrivilege	1664	61e7501c830d6_Tue23bdf4712a32.exe
Token: SeDebugPrivilege	872	61e7501c830d6_Tue23bdf4712a32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

61e7501c830d6_Tue23bdf4712a32.exe

description	pid	process	target process
PID 1664 wrote to memory of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe
PID 1664 wrote to memory of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe
PID 1664 wrote to memory of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe
PID 1664 wrote to memory of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe
PID 1664 wrote to memory of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe
PID 1664 wrote to memory of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe
PID 1664 wrote to memory of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe
PID 1664 wrote to memory of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe
PID 1664 wrote to memory of 872	1664	61e7501c830d6_Tue23bdf4712a32.exe	61e7501c830d6_Tue23bdf4712a32.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/872-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/872-65-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/1664-54-0x0000000000060000-0x00000000000EA000-memory.dmp

Filesize
552KB

Download
memory/1664-55-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

Filesize
4KB

Download
memory/1664-56-0x00000000004D0000-0x0000000000531000-memory.dmp

Filesize
388KB

Download
memory/1664-57-0x0000000076491000-0x0000000076493000-memory.dmp

Filesize
8KB

Download