32314767c8c086d799238e207fe9a1c20df3dc54d5a8e70bc207de3132405ad1

Analysis

Target

32314767c8c086d799238e207fe9a1c20df3dc54d5a8e70bc207de3132405ad1.exe
Size

349KB
MD5

7d0059703a03c00a854359850af2aa42
SHA1

af675feb97e0fa8b743c6df7bab39f5b9e481f5e
SHA256

32314767c8c086d799238e207fe9a1c20df3dc54d5a8e70bc207de3132405ad1
SHA512

9553cc9aa3c60d17ce4caa5122dc84889c91f7be10ee82cd004355446a6e2ea0497c64d4d260beb9c580b81d5b44d0e8f55a2214a857655300df33e5a9f20fa6

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
852	32314767c8c086d799238e207fe9a1c20df3dc54d5a8e70bc207de3132405ad1.exe
852	32314767c8c086d799238e207fe9a1c20df3dc54d5a8e70bc207de3132405ad1.exe

C:\Users\Admin\AppData\Local\Temp\32314767c8c086d799238e207fe9a1c20df3dc54d5a8e70bc207de3132405ad1.exe
"C:\Users\Admin\AppData\Local\Temp\32314767c8c086d799238e207fe9a1c20df3dc54d5a8e70bc207de3132405ad1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:852

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact