82cf47896339ec65c3f0e5edebd778d40862439d89af54ca2013695c3c684ea6

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82cf47896339ec65c3f0e5edebd778d40862439d89af54ca2013695c3c684ea6.exe
Size

778KB
MD5

5b2e2305ffc1e90f6ce092ee9da0f380
SHA1

3a9eddc03f793a84fa2deceeca476ea97c2d41b8
SHA256

82cf47896339ec65c3f0e5edebd778d40862439d89af54ca2013695c3c684ea6
SHA512

daeffc2ad3a36627919b828e701972248aea9caf94ceea3011f91e18e39acbedce502b89a88e05e6cd89e9de901b366fdb34ee927160d342988395c4d187f8da
SSDEEP

24576:1mt4TvJtw7uQAy8X8S/+zFKwoJS3kOpUwO5wQ:u4TvJWB8XZ/+ZKwoJS3kOpUwO5H

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
112	82cf47896339ec65c3f0e5edebd778d40862439d89af54ca2013695c3c684ea6.exe

C:\Users\Admin\AppData\Local\Temp\82cf47896339ec65c3f0e5edebd778d40862439d89af54ca2013695c3c684ea6.exe
"C:\Users\Admin\AppData\Local\Temp\82cf47896339ec65c3f0e5edebd778d40862439d89af54ca2013695c3c684ea6.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/112-55-0x0000000002AE0000-0x0000000002C26000-memory.dmp

Filesize
1.3MB

Download