54c047f47878134f13bf1d594568c41d5c895f0ba5552b6818716be167549123

Analysis

max time kernel
79s
max time network
98s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 05:54

Target

54c047f47878134f13bf1d594568c41d5c895f0ba5552b6818716be167549123.exe
Size

861KB
MD5

44c0f3994c14e90bf2cb07c51be3a8d0
SHA1

1f96153e065c360dd84e713832cbb5437135e0f4
SHA256

54c047f47878134f13bf1d594568c41d5c895f0ba5552b6818716be167549123
SHA512

bdf48f20c26a1f300f5467dbea5a2fa77afbce9001dd9b954547fe41f056635663bab67dfcc52169b1b80a0b5791a9c12222d91eb5e587666ff623af67fe7fae
SSDEEP

24576:3I9Of/lpHBhI/cO9iazWzSboa9bZgWXrGtpHK5HX6hoX3:N271boa9b5CR+HXgoX3

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
856	54c047f47878134f13bf1d594568c41d5c895f0ba5552b6818716be167549123.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/856-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download