ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:23

Target

ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f.exe
Size

935KB
MD5

3829c0d0c03f688cabfde0ccfed9788d
SHA1

8c2256859e009c372d6b5c7d528c2e6d492574a0
SHA256

ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f
SHA512

511f0bd6a1674657c8fad47ac854e77b5656e776161f769948e6dfd5176245ed991974eafe092d84d5387dece0f8420f3aa74cf531df6d6e0689ed78a4ec114c
SSDEEP

24576:TS3wMIoHWRiobe/rf8Qu7sHcE5NsLN7MGru1AV50cSb+j:uioHWwT/D8r7sHcOENn6S5v

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f.exe

pid process

1212 ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f.exe

pid	process
1212	ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f.exe
1212	ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f.exe
1212	ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f.exe
1212	ade54f01779384c36d78a13ddcae54af699b7639ded125a5747339ca60c9101f.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1212-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download