9edcf4905388c25cb2782272ed5458157c6fded7d6e5ef0439102f1c74fd9925

Analysis

max time kernel
5s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-02-2023 14:44

Target

BrowserCollector_x64.exe
Size

779KB
MD5

71b5e70a257f47dd6c9ead4f1010bd88
SHA1

f75c41ecbf6f34ca0048534d72f8847b37c38229
SHA256

9edcf4905388c25cb2782272ed5458157c6fded7d6e5ef0439102f1c74fd9925
SHA512

475fd6c74c835fcdc765b56bb7baa18926e6da6c497f160386429938148f9277447918a678b41c9bf1293988896530f4fcac17d1fa93f630a446263f07d9f45f
SSDEEP

12288:ksUHsZCB1OcBfiv3P6gIo/Bw9av4Xzo0P9MqETKTvNo4UvXCt:k3RB8Wfiv3PJImBw9ag5P9MqETWxI

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

BrowserCollector_x64.exe

description	pid	process	target process
PID 1096 wrote to memory of 2004	1096	BrowserCollector_x64.exe	cmd.exe
PID 1096 wrote to memory of 2004	1096	BrowserCollector_x64.exe	cmd.exe
PID 1096 wrote to memory of 2004	1096	BrowserCollector_x64.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\BrowserCollector_x64.exe
"C:\Users\Admin\AppData\Local\Temp\BrowserCollector_x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2004

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact