7a1ec17b2e3324e5e9080e4a7e4ee87f235d7dade94d8985d3fdd6a0924c913f

Analysis

Target

7a1ec17b2e3324e5e9080e4a7e4ee87f235d7dade94d8985d3fdd6a0924c913f.exe
Size

349KB
MD5

d4f6ef39b38a7dc4b25fed4e39e4457c
SHA1

bb410825f9b930021ed3efd27c989330a757cf86
SHA256

7a1ec17b2e3324e5e9080e4a7e4ee87f235d7dade94d8985d3fdd6a0924c913f
SHA512

62611848a6b1b37084fc6fa17a0d05feb27d48bdb386a2ebad2663ed186df7f14bcbce4fb9178d37d3e8abb28c0647a0d81df5e67365f714be367389b0b8b2a7

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3500	7a1ec17b2e3324e5e9080e4a7e4ee87f235d7dade94d8985d3fdd6a0924c913f.exe
3500	7a1ec17b2e3324e5e9080e4a7e4ee87f235d7dade94d8985d3fdd6a0924c913f.exe

C:\Users\Admin\AppData\Local\Temp\7a1ec17b2e3324e5e9080e4a7e4ee87f235d7dade94d8985d3fdd6a0924c913f.exe
"C:\Users\Admin\AppData\Local\Temp\7a1ec17b2e3324e5e9080e4a7e4ee87f235d7dade94d8985d3fdd6a0924c913f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact