37f06f87355592007d3f0a6acc3e0535b0a5d5d2e224280e5a5f8792cf88c9e4 | Triage

Analysis

max time kernel
4294178s
max time network
125s
platform
windows7_x64
resource
win7-20220310-en
submitted
07-04-2022 14:58

Sharing

Report Analysis Logs

General

Target

b1d856afe8ffd2649843d64affe9d4c3.exe
Size

3.9MB
MD5

b1d856afe8ffd2649843d64affe9d4c3
SHA1

6015d16a00f0c4ad3d68c8c83ae20305a1127a99
SHA256

37f06f87355592007d3f0a6acc3e0535b0a5d5d2e224280e5a5f8792cf88c9e4
SHA512

6c707636d934cfeefc42271d3bc4ca82cb243ed42b5bf2f999f7529cb4a761365bb94382d38ed4c0e9549ff9580d627414d3461ace467a8986faeaaf08707cab

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b1d856afe8ffd2649843d64affe9d4c3.exe

description pid process

Token: SeManageVolumePrivilege 1640 b1d856afe8ffd2649843d64affe9d4c3.exe

C:\Users\Admin\AppData\Local\Temp\b1d856afe8ffd2649843d64affe9d4c3.exe
"C:\Users\Admin\AppData\Local\Temp\b1d856afe8ffd2649843d64affe9d4c3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-54-0x0000000076361000-0x0000000076363000-memory.dmp

Filesize
8KB

Download
memory/1640-55-0x00000000030D0000-0x00000000030E0000-memory.dmp

Filesize
64KB

Download
memory/1640-61-0x0000000003270000-0x0000000003280000-memory.dmp

Filesize
64KB

Download