bcce8e51552e7810d696f563d345db9d123dc3d15061bfdc8037e17cf8b15977

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcce8e51552e7810d696f563d345db9d123dc3d15061bfdc8037e17cf8b15977.exe
Size

7.5MB
MD5

a94454236aa9ec0839399191875fdbf3
SHA1

1bde5be455f396f19917e381ce9050facc7c754c
SHA256

bcce8e51552e7810d696f563d345db9d123dc3d15061bfdc8037e17cf8b15977
SHA512

15d216fc37772d9049ef54dc926dbecf2a051192314b040ceb85d944affe463694caba2e9806e96b5cf7b637655fb4949de8d638023811a2e5dea46466691b8b
SSDEEP

49152:Odu5HFkKKs2rb/T4vO90d7HjmAFd4A64nsfJA+WETLSf4NxwKoGfTOcoG2p92uy+:Jkm7VKOOpEiEXkuzJ9AlE1xdWky

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1132	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1132	1700	bcce8e51552e7810d696f563d345db9d123dc3d15061bfdc8037e17cf8b15977.exe	28
PID 1700 wrote to memory of 1132	1700	bcce8e51552e7810d696f563d345db9d123dc3d15061bfdc8037e17cf8b15977.exe	28
PID 1700 wrote to memory of 1132	1700	bcce8e51552e7810d696f563d345db9d123dc3d15061bfdc8037e17cf8b15977.exe	28

C:\Users\Admin\AppData\Local\Temp\bcce8e51552e7810d696f563d345db9d123dc3d15061bfdc8037e17cf8b15977.exe
"C:\Users\Admin\AppData\Local\Temp\bcce8e51552e7810d696f563d345db9d123dc3d15061bfdc8037e17cf8b15977.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\cmd.exe
  cmd.exe /c "del C:\Users\Admin\AppData\Local\Temp\bcce8e51552e7810d696f563d345db9d123dc3d15061bfdc8037e17cf8b15977.exe"
  2⤵
  - Deletes itself
  PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...