007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be

Analysis

max time kernel
185s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe
Size

937KB
MD5

7d11e267ae20398351b87a5263c862ef
SHA1

47eae161608cb2fb7c3d1d544b81fbe095bb0585
SHA256

007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be
SHA512

b0cb13bcdb6389c7e6de1fabf6ad6fd2d871be5e3cf570267d131fa01dc8e467be61e55088b00db6e2d7341d1d91a97124603f4090e35921b62d5edf8e0e491b
SSDEEP

24576:eLii0FS812mMs549d0ij+BgFoFoGQI9mWuYAHsbYcSlK:e30E812Dh9d0tBgFoFoI0Wesb

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe

pid	process
1396	007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe
1396	007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe

pid	process
1396	007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe
1396	007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe
1396	007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe
1396	007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe

C:\Users\Admin\AppData\Local\Temp\007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe
"C:\Users\Admin\AppData\Local\Temp\007ff392964aab394bf1e52d80366d9ceb32203c0dab8de1eda39f63123179be.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads