0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44

Analysis

Target

0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe
Size

196KB
MD5

82ae7aa68ef4c8b32e67883b3c734822
SHA1

caa3e5488432c54e7d8cffceba839cf07fdbd672
SHA256

0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44
SHA512

2d609fb0cbe73922d6542ca579236fe54cc080f4ba22c9f4f7cc372e8dbb73376486ea16a81c39f71c5cfa9f131eac4d513abb42ef81bccc8ffa7b1f2c26ad86

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe

description	pid	process	target process
PID 2524 wrote to memory of 2904	2524	0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe	0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe
PID 2524 wrote to memory of 2904	2524	0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe	0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe
PID 2524 wrote to memory of 2904	2524	0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe	0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe

C:\Users\Admin\AppData\Local\Temp\0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe
"C:\Users\Admin\AppData\Local\Temp\0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe
  C:\Users\Admin\AppData\Local\Temp\0cfeda3314e0929cf7047e657912c610ad345356b68c9d6edd95711c31adfb44.exe dfsr
  2⤵
  PID:2904

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/2524-130-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2524-131-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2904-132-0x0000000000000000-mapping.dmp

Download