a908fec53fa4a3e9a1c233454b9c1e18a971ac879620933e99d56adc9b1e75db

Analysis

Target

a908fec53fa4a3e9a1c233454b9c1e18a971ac879620933e99d56adc9b1e75db.exe
Size

655KB
MD5

6204680e5d212e22d3c0b36f293d62ec
SHA1

580d315e8d3b8da96363ea086b2f3e18c06500ac
SHA256

a908fec53fa4a3e9a1c233454b9c1e18a971ac879620933e99d56adc9b1e75db
SHA512

ff37b100a569c3b85953536f7633ba72aaf6ad9dc607ccddd04302e4aa4b22b71a2e744173d737bdc654fda086a47bb83ae1e8844713217934c898b1c812a12e

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3996	a908fec53fa4a3e9a1c233454b9c1e18a971ac879620933e99d56adc9b1e75db.exe
3996	a908fec53fa4a3e9a1c233454b9c1e18a971ac879620933e99d56adc9b1e75db.exe

C:\Users\Admin\AppData\Local\Temp\a908fec53fa4a3e9a1c233454b9c1e18a971ac879620933e99d56adc9b1e75db.exe
"C:\Users\Admin\AppData\Local\Temp\a908fec53fa4a3e9a1c233454b9c1e18a971ac879620933e99d56adc9b1e75db.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact