48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 05:22

Target

48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe
Size

1.0MB
MD5

911da0ffcb7ef735117752c2afc08003
SHA1

b8352895ccc6141dd03f97ad6b4b1b2f52b8bc23
SHA256

48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab
SHA512

a176729c59538b2b72616e8432a6ecf0307af8e71b163489bc15685ed0000d94edf2dfbb58a0e32cc30fba8a533c345da885c8bfb9354ff692bc09449e9a5889
SSDEEP

24576:IB8+mu4DXEz/XVsR0FJc78OhJBgRPflYm8CcP2FRGmbl+aoNtAG:IOgWe+EYmEaoN7

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
620	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27
PID 1480 wrote to memory of 620	1480	48a316060d5c2648996802e475e184041bf35e33613f50aefdbb81001e5166ab.exe	27

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/620-54-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/620-55-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/620-57-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/620-59-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/620-61-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/620-63-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/620-65-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/620-68-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/620-69-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/620-70-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/620-71-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download