4b56f06c41fb17b2e445bee3e4016d3297f758cbb20b3fc280763593813242df

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2023, 15:59

Target
06dae81361384254ec8d772bd52660a0.exe
Size 7.4MB
Sample230111-te4jgadd87
SHA256 4b56f06c41fb17b2e445bee3e4016d3297f758cbb20b3fc280763593813242df
MD5 06dae81361384254ec8d772bd52660a0
SHA1 99e2ccbcc47877c3d240ec6677696a0f24646a3f
SHA512 002df3c9d5f999029fe3c61a5d0d14a9dd7faf3ad41b13c1a6d97c898693d7ed0335a3519541e62aad515495b2727d1d54a2694e01a543098a8e4de3ede7c85a
SSDEEP 49152:q+ECqxAZCcGIrb/ThvO90d7HjmAFd4A64nsfJZ+vKpq0xOTDueLs6JNdkHoIuE/K:wzhFETj3GY1KhEbAzSAn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3872	2100	06dae81361384254ec8d772bd52660a0.exe	80
PID 2100 wrote to memory of 3872	2100	06dae81361384254ec8d772bd52660a0.exe	80
PID 3872 wrote to memory of 3116	3872	cmd.exe	82
PID 3872 wrote to memory of 3116	3872	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\06dae81361384254ec8d772bd52660a0.exe
"C:\Users\Admin\AppData\Local\Temp\06dae81361384254ec8d772bd52660a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\06dae81361384254ec8d772bd52660a0.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 0
    3⤵
    PID:3116

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact