44d9ec7cd1bd3d6c91ea6d4a68436f2114f04eb0db143598e74f1fe44babab2b

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:05

Target

44d9ec7cd1bd3d6c91ea6d4a68436f2114f04eb0db143598e74f1fe44babab2b.exe
Size

855KB
MD5

6a290a00d2366b927426d80cca11a610
SHA1

bafbfc944968ed6344dd88233af672f2478d890d
SHA256

44d9ec7cd1bd3d6c91ea6d4a68436f2114f04eb0db143598e74f1fe44babab2b
SHA512

77d51ae8d89ecc2ebb6417ff7eb98cadcc0ec4349bb50c8807e2c17c1d8d7d9b0ba81afd4bdf0528c560da3ee8e7e58348fbe342b49cc1187ade482bf1862d1a
SSDEEP

24576:SI9Of/lpHBhI/cO9iazWzSboa9bZgWXrGtpHK5HXWhoX:w271boa9b5CR+HXcoX

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1964	44d9ec7cd1bd3d6c91ea6d4a68436f2114f04eb0db143598e74f1fe44babab2b.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1964	44d9ec7cd1bd3d6c91ea6d4a68436f2114f04eb0db143598e74f1fe44babab2b.exe
1964	44d9ec7cd1bd3d6c91ea6d4a68436f2114f04eb0db143598e74f1fe44babab2b.exe
1964	44d9ec7cd1bd3d6c91ea6d4a68436f2114f04eb0db143598e74f1fe44babab2b.exe
1964	44d9ec7cd1bd3d6c91ea6d4a68436f2114f04eb0db143598e74f1fe44babab2b.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1964-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download