4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad

Analysis

max time kernel
82s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2022, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
Size

1.1MB
MD5

07529dbc5603cacb426137b0fa110e46
SHA1

7f88cf7634a633bf2d311fb1f24726c5d5a88259
SHA256

4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad
SHA512

7676810ebc8394fbd0b84e3b7f9d6e06afa8edf3e93e80aeacf842deacfb1a13190b1238ff2212ff4f1ad831388f4e862328547317a24ddecac0b229e3ca73bc
SSDEEP

24576:93KpBwAVg/iAsm4jsPGWjz+Toleqz7Pqyz+/m5ijbLHB:Uww0eooyTqyS/mEvjB

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4884	4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe	87
PID 4364 wrote to memory of 4884	4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe	87
PID 4364 wrote to memory of 4884	4364	4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe	87

C:\Users\Admin\AppData\Local\Temp\4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe
"C:\Users\Admin\AppData\Local\Temp\4064c1351b8230044acd3b03b5a4bc856c6cfb05676a42f041d8094297ea33ad.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt5486.bat
  2⤵
  PID:4884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bt5486.bat

Filesize
1KB

MD5
9088c37055256eabb9ec6585d6ff3778

SHA1
25f8f87d4e64f3f2c2bf1673ade6586bd51df518

SHA256
c6c25e54831235db692131b6071805aa8ef75bc8fa3669d4d5c9f5d78a205563

SHA512
6d3a994a4dd018baab34ee72446f0fb5d456c560414bdeab65cd00019d51a498e084fe08300a918755f6de4ac12fcd1c6ac4dcf0abd72c8ea190c555ff67d3ee

Download Submit
memory/4364-1482-0x0000000000400000-0x0000000000574000-memory.dmp

Filesize
1.5MB

Download
memory/4364-134-0x00000000762C0000-0x00000000764D5000-memory.dmp

Filesize
2.1MB

Download
memory/4364-136-0x0000000075AA0000-0x0000000075C40000-memory.dmp

Filesize
1.6MB

Download
memory/4364-137-0x0000000077510000-0x000000007758A000-memory.dmp

Filesize
488KB

Download
memory/4364-1481-0x0000000000400000-0x0000000000574000-memory.dmp

Filesize
1.5MB

Download
memory/4364-132-0x0000000000400000-0x0000000000574000-memory.dmp

Filesize
1.5MB

Download
memory/4364-1483-0x0000000000400000-0x0000000000574000-memory.dmp

Filesize
1.5MB

Download
memory/4364-1484-0x0000000000400000-0x0000000000574000-memory.dmp

Filesize
1.5MB

Download
memory/4364-133-0x0000000077800000-0x00000000779A3000-memory.dmp

Filesize
1.6MB

Download
memory/4364-1487-0x0000000000400000-0x0000000000574000-memory.dmp

Filesize
1.5MB

Download
memory/4364-1488-0x00000000022F0000-0x00000000023F0000-memory.dmp

Filesize
1024KB

Download
memory/4364-1489-0x00000000022F0000-0x00000000023F0000-memory.dmp

Filesize
1024KB

Download