5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5

Analysis

max time kernel
185s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 04:06

Target

5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe
Size

1.0MB
MD5

1b09d4d6a1f8f12f0547dcd105277874
SHA1

b642b097a6273143ce8b2ad06cc4588fc9e698b1
SHA256

5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5
SHA512

70bad632526dffdd938bac618f172436a84804610ed024894311c29d633fe252e673b303bba5877fd520ca018dba46f5cda72d199b946c31c18c687926c0fcaa
SSDEEP

12288:zs05EW5k2yfDLuLtc7YI4QcOTLCQhiv0KxjeU/S23v3oQ5buN3W5pKO:zT5EWU+LtKYIX3CTxJeU/vt5buNmGO

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2224	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe
2224	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2224	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe
2224	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe
2224	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe
2224	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81
PID 4764 wrote to memory of 2224	4764	5eecb689803bfbda55ea6a90123d73c09749cf40949a7bc02f86f49af40039a5.exe	81

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/2224-133-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2224-134-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2224-135-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2224-136-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2224-137-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download