a92eb413ce276767d99b6d0a99b283f70a3cb5bcbcbee91bae902f3a6a314b17 | Triage

Analysis

max time kernel
24s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a92eb413ce276767d99b6d0a99b283f70a3cb5bcbcbee91bae902f3a6a314b17.exe
Size

440KB
MD5

d52a74e98e1f70d6728003009ce9f4c0
SHA1

75599f1c2abee6b8cded28bd9510995a9aa8a214
SHA256

a92eb413ce276767d99b6d0a99b283f70a3cb5bcbcbee91bae902f3a6a314b17
SHA512

4b10bf6febb6a00eacacb27bcb590eb100db835a46fa85e0c887828292e9c64dff5256570bac6fb738af0557d549ca9fc4904591cef700616bd558f093104276
SSDEEP

12288:T/XM4DShe9EcHPLrLZ5AICgkTP3/HvvNVR:LM4DSs9FvzAICgkTPvzR

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\a92eb413ce276767d99b6d0a99b283f70a3cb5bcbcbee91bae902f3a6a314b17.exe
"C:\Users\Admin\AppData\Local\Temp\a92eb413ce276767d99b6d0a99b283f70a3cb5bcbcbee91bae902f3a6a314b17.exe"
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download