601243aef0e2f9e945dc5ae5324517d31726f452acd54543cc106d691687710e

Analysis

max time kernel
155s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 03:01

Target

downloaded.exe
Size

87KB
MD5

f512ab1d4a38bdfe39451bf678f6bbae
SHA1

f4d0be2ed6febb20b16e3cd0807a58c5efed7ea1
SHA256

601243aef0e2f9e945dc5ae5324517d31726f452acd54543cc106d691687710e
SHA512

d9c84b35f9b3504ca2214113e1325b44f13fd9b5171f8475789b935241316f335c14c9c80ef20aabc7236a21cb17e11ad5ebccff4f08d56f6c75f4c8e19c7bad
SSDEEP

1536:OAGCTGyPsL+l5teICPJNR1xWoE9MZiwUt6Cxwe1L71hpctusinVKka:OAGCTfEqln1eR1xMWZiwUxVc4siV/

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	downloaded.exe
4596	downloaded.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3604	4596	downloaded.exe	82
PID 4596 wrote to memory of 3604	4596	downloaded.exe	82
PID 4596 wrote to memory of 3604	4596	downloaded.exe	82
PID 3604 wrote to memory of 4520	3604	cmd.exe	83
PID 3604 wrote to memory of 4520	3604	cmd.exe	83
PID 3604 wrote to memory of 4520	3604	cmd.exe	83

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Microsoft\Tsk.xml

Filesize
1KB

MD5
fff9a631690bf8c295aee02b77019554

SHA1
526f44efaaa8ff7c9168af631bacd244461509bb

SHA256
2a185af151e981b8af80bfa2b0c0d47909b0780f6245a9f8f983ae454dfb5547

SHA512
c10504fd0c843a47e4cd957028ac1a5d53c269fab66c6bd5b18d5baad2159ac0728c9573c8650d421da79830e57737fe23a86283e10b7edf8889f9d2bfb927da

Download Submit