0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
Size

1.7MB
MD5

898bee8c181f77406ef340b65755ba97
SHA1

f87aade2df5f5cbb1333dab2a433e867b883961c
SHA256

0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d
SHA512

f6de2db1af8958e37b65e1fafa57b76af1f28a09861229f0b3da216340b814bd830077be3631975b06d5856f89288f093dcb996d8a1189502ad3d7d0ceac4368
SSDEEP

49152:9nqmARra0Ee/k/PlvOsXNAmpZ3d5UK3dvPNJl36d3SLANOossJuD:XRFnosswD

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe

description	pid	process	target process
PID 2200 set thread context of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe

pid	process
3604	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
3604	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
3604	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
3604	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe

pid	process
3604	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
3604	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
3604	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
3604	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe

description	pid	process	target process
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
PID 2200 wrote to memory of 3604	2200	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe	0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe

C:\Users\Admin\AppData\Local\Temp\0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
"C:\Users\Admin\AppData\Local\Temp\0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2200

C:\Users\Admin\AppData\Local\Temp\0e6ecfd54b573639fbc1fad937520feb7e1ee2dc0eaf3dd28a7b97445f03830d.exe
/novalidation
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3604

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3604-132-0x0000000000000000-mapping.dmp

Download
memory/3604-133-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/3604-134-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/3604-135-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/3604-136-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/3604-137-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download