4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb

Analysis

max time kernel
100s
max time network
123s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 05:18

Target

4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe
Size

1.0MB
MD5

b9172fc371a4c6105158a278d60667e1
SHA1

81794f23fa4d329b4f6ce29cb0f4ed5423db8515
SHA256

4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb
SHA512

31c754e25d9a829c6e96d2d9153646e568c6283f67a76438adca4b302cc1955c66afa8102522089f0bd5189b34fb456a919efdea0998596a87e9821f47c2c308
SSDEEP

24576:0B8+mu4DXEz/XVsR0FJc78OhJBgRPflYm8CcP2FRGmbl+aoNtpD:0OgWe+EYmEaoN/

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1776	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27
PID 2040 wrote to memory of 1776	2040	4c37e702026f372a30953af64ab4e3e18b5a63c0c284872925495e9bba064ffb.exe	27

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1776-54-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1776-55-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1776-57-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1776-59-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1776-61-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1776-63-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1776-65-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1776-68-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1776-69-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1776-70-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1776-71-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download