8f60d63d5ef79da43fdcf7ee0563056d73f6e5d33f2b106a53ce34e00786e5c1 | Triage

Analysis

max time kernel
143s
max time network
130s
platform
windows7_x64
resource
win7-en-20211208
submitted
06-02-2022 10:54

Sharing

Report Analysis Logs

General

Target

8f60d63d5ef79da43fdcf7ee0563056d73f6e5d33f2b106a53ce34e00786e5c1.exe
Size

671KB
MD5

50bf345919a1661137ae2a6e8d1973c6
SHA1

8f5eb9bdc38a13eb2fd923a7b6d2b57330f69955
SHA256

8f60d63d5ef79da43fdcf7ee0563056d73f6e5d33f2b106a53ce34e00786e5c1
SHA512

22b39d457addc3479e545d8ed0aa76559af43c1f6c06ad683307b2b1d5f2defef1c3a08b11ac7428369495ad14b4273f4c4284812e4cd37b6b7c4ddc402cd62b

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8f60d63d5ef79da43fdcf7ee0563056d73f6e5d33f2b106a53ce34e00786e5c1.exe

pid process

2036 8f60d63d5ef79da43fdcf7ee0563056d73f6e5d33f2b106a53ce34e00786e5c1.exe

C:\Users\Admin\AppData\Local\Temp\8f60d63d5ef79da43fdcf7ee0563056d73f6e5d33f2b106a53ce34e00786e5c1.exe
"C:\Users\Admin\AppData\Local\Temp\8f60d63d5ef79da43fdcf7ee0563056d73f6e5d33f2b106a53ce34e00786e5c1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-56-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download