80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 22:21

Target

80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe
Size

290KB
MD5

d52437554abe4de8ba586d02398bbb76
SHA1

005238a22deab58f46768e8f0ae5c8926b128cd3
SHA256

80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70
SHA512

d93fe0a9638543a16b2444e4ba54af9e26f5ce59e84d910494ca487bc93fa2a8f2016acaff493f821bf75e9c64dbe8cc08f16b2e7c4ff110db54121fff5010fb
SSDEEP

6144:fdFQ2RKpq4J2Pd5pv3c9YN/Dg7XAge/o+2VO9iz8irZ/NBwxhqN:fU2cpR2V5pbNUwswvirZ/NGxI

Score

7^/10

spyware stealer

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1116	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe
Token: SeDebugPrivilege	1116	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27
PID 1492 wrote to memory of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27
PID 1492 wrote to memory of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27
PID 1492 wrote to memory of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27
PID 1492 wrote to memory of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27
PID 1492 wrote to memory of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27
PID 1492 wrote to memory of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27
PID 1492 wrote to memory of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27
PID 1492 wrote to memory of 1116	1492	80bb75b593e95859adf5c8a7d76c4f90c4f4e198eb2a26360790107c1557dc70.exe	27

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1116-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1116-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1116-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1116-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1116-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1116-61-0x000000000040C86E-mapping.dmp

Download
memory/1116-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1116-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1116-68-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1116-69-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-67-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download