3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b

Analysis

max time kernel
186s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 00:19

Target

3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe
Size

1.0MB
MD5

3678d5bee06a37e5c3698c234ad794c5
SHA1

774f3c5c2585bc2fd3834d0fc2662b613a91fdd8
SHA256

3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b
SHA512

567c8fffe7ab79ef5d1217a48c2aec283219dc131c13ad65e1016c5f981dc525bc822d7af7ed3ebf0146e58b82637a22b9a2fd77cace3807f53a541561115fec
SSDEEP

24576:WtPzsaPxK4VBF6NHLsn5BB1nxdM6y9N1Fu0hyRl/:soaPxNF6ent1x+6y9Nt0d

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4588	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe
4588	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4588	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe
4588	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe
4588	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe
4588	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83
PID 5088 wrote to memory of 4588	5088	3100c094e0adf9dae8e234095170fbcb5533c62ef08fcd9af892672b669c9d5b.exe	83

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/4588-133-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/4588-134-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/4588-135-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/4588-136-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/4588-137-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download