ae49804490f4208c2e8a1e157b6c8c748d4be2dcdad957b467431a8cbcdc71be | Triage

Analysis

max time kernel
8s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 20:53

Sharing

Report Analysis Logs

General

Target

ae49804490f4208c2e8a1e157b6c8c748d4be2dcdad957b467431a8cbcdc71be.exe
Size

17KB
MD5

22da9417c632dceab09f290b115bf9b5
SHA1

03c5b030c784cf0cc8445bc1c71acf6c0fe080e8
SHA256

ae49804490f4208c2e8a1e157b6c8c748d4be2dcdad957b467431a8cbcdc71be
SHA512

f057162f930028e92324886f2f7b885ba5600afc1f00a5b973abb5328e7cd0c6a5ac0221454cee511095878541f344553a9052024596ce9b70b10a03a4d3cabc
SSDEEP

384:Fa3KAaGaNLxUz7ObrIwwvMx0n8y6ElFjOg:Q9lwLlrIPvMxhy64jOg

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\ae49804490f4208c2e8a1e157b6c8c748d4be2dcdad957b467431a8cbcdc71be.exe
"C:\Users\Admin\AppData\Local\Temp\ae49804490f4208c2e8a1e157b6c8c748d4be2dcdad957b467431a8cbcdc71be.exe"
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download