5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516

Analysis

max time kernel
132s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe
Size

1.3MB
MD5

daa34e5d2c2717dcf6bb6a0afb56901f
SHA1

be68170614baa9f889d37cbb7ad708ed619e1ca3
SHA256

5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516
SHA512

e6e6ab25d998047e9c2104a37df0c7c6f30afcc50fd4acbd6299b7253b77ffadf5082b0a2f123371b6f8169320b8d65f3ce50df713bd7f314240d809d98052e4
SSDEEP

24576:nBT7a45fdhGL836ISF8zyi5lhZL6HbOOBB2U5gTpZSAaucSsAMb:VPOL83w8Oi5lhZL6iOH58ZC2M

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe

pid	process
808	5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe
808	5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe

pid	process
808	5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe
808	5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe
808	5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe
808	5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe

C:\Users\Admin\AppData\Local\Temp\5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe
"C:\Users\Admin\AppData\Local\Temp\5d6d6705d7c94d7ad3f594769ec1a85fdae93431c182fabdf99439b05ab8c516.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads