bfc6ccc2493e9b59e0fa090d756e64e766057f87d9c68b825941879e42a2945a

Analysis

max time kernel
12s
max time network
52s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 04:55

Target

bfc6ccc2493e9b59e0fa090d756e64e766057f87d9c68b825941879e42a2945a.exe
Size

973KB
MD5

b7951cf8390e820e664b5e9c3895ea61
SHA1

98720f5f0cf46e23094317ab302edaf876b5e685
SHA256

bfc6ccc2493e9b59e0fa090d756e64e766057f87d9c68b825941879e42a2945a
SHA512

4d82c2518dd0888c371a05e296c0abcba5f9c89ddda82e4a58bfb44af466873f857bfa24b0e6c735544dc3780a6bc05b7bad3e10a0f4c466e88c320f1f5e578f
SSDEEP

24576:K+wU+0GRJBMyaosJdRnPUKGh6qltQpoRGbkZMA0uSrrr7wH5:IR0GRJ5RsBPUKGhtQugkZO9a5

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1460	bfc6ccc2493e9b59e0fa090d756e64e766057f87d9c68b825941879e42a2945a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1460-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download