62f45022301ecf63a5e00179f104b3cc1fb98b176a0d1a2ef92324a11ff46d18

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30/01/2023, 19:33

Target

0eb2e5fcf4c969dff84f19999e62b3b3ee9c42f42eb06e6b961ed093071ab2c2.exe
Size

2.5MB
MD5

c423b2a38d2493e430bbddcf282d07fa
SHA1

7ce78de4ac1e0a1f470905d2511455ec86471668
SHA256

0eb2e5fcf4c969dff84f19999e62b3b3ee9c42f42eb06e6b961ed093071ab2c2
SHA512

b2e1eb5b9f4506baf49641195152840d6919121f0385bd37d21c2e8cfb7138f1764618a59df4455cc759b4054c50661f7200a1aed3c4791349128e4595f3f66a
SSDEEP

49152:XR60kSiIbh+N6WL+HkwqlmadOmxEbn5E8E208VcwsI8MrHdiiIOZx4O+g20cs908:h60kSiIdY6uWkw8dOmxEbn5E8E20ucwr

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 344	532	0eb2e5fcf4c969dff84f19999e62b3b3ee9c42f42eb06e6b961ed093071ab2c2.exe	28
PID 532 wrote to memory of 344	532	0eb2e5fcf4c969dff84f19999e62b3b3ee9c42f42eb06e6b961ed093071ab2c2.exe	28
PID 532 wrote to memory of 344	532	0eb2e5fcf4c969dff84f19999e62b3b3ee9c42f42eb06e6b961ed093071ab2c2.exe	28
PID 532 wrote to memory of 344	532	0eb2e5fcf4c969dff84f19999e62b3b3ee9c42f42eb06e6b961ed093071ab2c2.exe	28

C:\Users\Admin\AppData\Local\Temp\0eb2e5fcf4c969dff84f19999e62b3b3ee9c42f42eb06e6b961ed093071ab2c2.exe
"C:\Users\Admin\AppData\Local\Temp\0eb2e5fcf4c969dff84f19999e62b3b3ee9c42f42eb06e6b961ed093071ab2c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
  2⤵
  PID:344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact