ab271dbdb2fe1167e203eb5693a107b5f75a4abc427990f1610c6f36798e0575

Analysis

max time kernel
165s
max time network
172s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
28-03-2023 03:38

Target

ab271dbdb2fe1167e203eb5693a107b5f75a4abc427990f1610c6f36798e0575.exe
Size

4.3MB
MD5

c3d8ee8d15499dcb98d390faa1db03e0
SHA1

f95a309ec2b8d114518fffc4722898e1e3229da4
SHA256

ab271dbdb2fe1167e203eb5693a107b5f75a4abc427990f1610c6f36798e0575
SHA512

56b166f46acec2b83726ed03ba0a6ab959b79aa502ee37959601b14387a60f88459bb35ecb8e5b34f7f4649e8c89640c102877ef3ca3e8db145793de6cb79828
SSDEEP

98304:6ap4irM3hZlWJG58Cch6a+UWiOoZVQWKVxBmddK8V+i4A:miriPl35fPUWXunKsdd1+g

Score

7^/10

spyware stealer upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2052-121-0x0000000001030000-0x0000000001E91000-memory.dmp	upx
behavioral2/memory/2052-122-0x0000000001030000-0x0000000001E91000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ab271dbdb2fe1167e203eb5693a107b5f75a4abc427990f1610c6f36798e0575.execmd.exe

description	pid	process	target process
PID 2052 wrote to memory of 2508	2052	ab271dbdb2fe1167e203eb5693a107b5f75a4abc427990f1610c6f36798e0575.exe	cmd.exe
PID 2052 wrote to memory of 2508	2052	ab271dbdb2fe1167e203eb5693a107b5f75a4abc427990f1610c6f36798e0575.exe	cmd.exe
PID 2508 wrote to memory of 2496	2508	cmd.exe	choice.exe
PID 2508 wrote to memory of 2496	2508	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\ab271dbdb2fe1167e203eb5693a107b5f75a4abc427990f1610c6f36798e0575.exe
"C:\Users\Admin\AppData\Local\Temp\ab271dbdb2fe1167e203eb5693a107b5f75a4abc427990f1610c6f36798e0575.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\ab271dbdb2fe1167e203eb5693a107b5f75a4abc427990f1610c6f36798e0575.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2508

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/2052-121-0x0000000001030000-0x0000000001E91000-memory.dmp

Filesize
14.4MB

Download
memory/2052-122-0x0000000001030000-0x0000000001E91000-memory.dmp

Filesize
14.4MB

Download