88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9

General

Target

88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
Size

317KB
MD5

825bfec3c930f35b839fcccede6c5403
SHA1

67c8e7ed1767b222402735e106705dac2fff9f36
SHA256

88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9
SHA512

1e9479c650ffd2b986ab8458ba3a112a2dc35925a42651835dda4e39566aeff1d7bc6ea1700c6223a5c77f64b26663a2480004dc589d2a37b678111a19178d6d
SSDEEP

6144:UztqTM83hCmba+BEwSjOYemfTBFux0EySw7SBBtCHf6xaB5Gk7vO9lD7z:UztU/3hCUlSj1emf80QPztIQatDS7z

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe

pid	process
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
1676	88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe

pid process

1676 88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe

C:\Users\Admin\AppData\Local\Temp\88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe
"C:\Users\Admin\AppData\Local\Temp\88e3c6910a9dbd49d617ec4452e74c0914a63f7d5ff4295cc1adc8feeeeef0c9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-132-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1676-133-0x0000000002240000-0x0000000002243000-memory.dmp

Filesize
12KB

Download
memory/1676-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download

Analysis

Sharing