c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5

Analysis

max time kernel
280s
max time network
340s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe
Size

1.3MB
MD5

c333b9428e66c48b3b8ec48b3a1a42c6
SHA1

def43ab6e3886e02aed9f30e8d9950f4da6af30f
SHA256

c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5
SHA512

810eb9e469f1d43ee8ea5b1f0a7bc674c2e5a686254aa99cd1872b00800bf2c6d701270b81e034c6a4f34078903b18c9e319be5e0da82192550695234699fe0f
SSDEEP

24576:vCbV1tebpntzapYXTul7JOaNBbArSv8e0ZtAEZcSZqNT:sEbpnKoTul7JOaNOrve0Z1+NT

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe

pid	process
1324	c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe
1324	c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe

pid	process
1324	c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe
1324	c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe
1324	c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe
1324	c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe

C:\Users\Admin\AppData\Local\Temp\c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe
"C:\Users\Admin\AppData\Local\Temp\c7a5d5fc06c7a78b5a8316dcfada5aa5e5ef43138d3c583d3e00802275fd10c5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads