2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 05:58

Target

2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe
Size

1.0MB
MD5

e5a607a5a854fc05b0d6f981d722e2d3
SHA1

bc32ef19ce9ce803bdcc5274dac7a880017f43e9
SHA256

2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f
SHA512

2a16653ed592e02fff9d9458b8bae0eaa4f6976072bb7e936872ced18b3dd3529cf1bd641b0f1c8d1e79776ab0368a734f6505cb85e2e87599b7b8feff6c6bbb
SSDEEP

24576:295uqjWw1f0QCp4iUTXOkP0IifXXa1+sNsuqY5nI5z:Y4j+f0Q+4i2OkP0I8Xe+s9qqIp

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
628	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
628	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe
628	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe
628	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe
628	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27
PID 960 wrote to memory of 628	960	2f72f33ba07e5aad80d553e04907773ae41abe39277b8d0dda95bff8e4e83e6f.exe	27

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/628-54-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-55-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-57-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-59-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-61-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-63-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-65-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-69-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-68-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/628-70-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-71-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download