e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a

General

Target

e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
Size

2.4MB
MD5

400795b89cbd380a8f5f8052f7cbc468
SHA1

7b0104528db67dd504cacce5dff073c652e26b86
SHA256

e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a
SHA512

067e3d107fc7d38ce5cc0910e5ee21956e99486077381e998243fa1e894acd7904800846024f8d528d241e58a2059ce33cafe5b229e4c8d945bc50fc89e25283
SSDEEP

49152:6UjnYYtIu5JSSlOYtV7YZjtieTed5TcK:68nYztPeo

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe

pid	process
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
3440	e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe

pid process

3440 e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe

C:\Users\Admin\AppData\Local\Temp\e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe
"C:\Users\Admin\AppData\Local\Temp\e4bce6b83699042d0c794e5e47ee21470b5ad9a33e9e72b046d561f6ff1cb25a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3440