033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 11:11

Target

033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe
Size

1.0MB
MD5

3f45610ddf6dbdc01260c5b9afb06855
SHA1

4efbebe675e2fd13b169d5ce4df18839267df192
SHA256

033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890
SHA512

041e1d417445619e24dcf3617fde1d4918dbff7ab1c41bc41e1b31a08365b7594212f5bb83f78a599fe33e2df675657a77db8e89f9c4d570b4359246275c0e20
SSDEEP

24576:k95uqjWw1f0QCp4iUTXOkP0IifXXa1+sNsuqYynI5E:y4j+f0Q+4i2OkP0I8Xe+s9qTIi

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4204 set thread context of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3404	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe
3404	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3404	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe
3404	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe
3404	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe
3404	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80
PID 4204 wrote to memory of 3404	4204	033a2cd1bbb460ae162dfe9a041bde134d4e772caf4af5cee8f7e48457643890.exe	80

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/3404-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3404-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3404-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3404-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3404-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download