384ef7e5fb49e3531ec4dd56cd32ffb75de628b652072e72358ed9b917bbc69d

Analysis

max time kernel
84s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2023, 17:29

Target

7105772ce15ee52a37672f39ee767e05.bin.exe
Size

8.6MB
MD5

7105772ce15ee52a37672f39ee767e05
SHA1

8ef8226a52565a19ce0fe6da5459a8a831a0ad81
SHA256

384ef7e5fb49e3531ec4dd56cd32ffb75de628b652072e72358ed9b917bbc69d
SHA512

85faa0dfe677f0c8bbe0de2146788c2ea967d623c33f2273e5f7ae7c028c2791cfdb45cef587e7f81326164140db06c18d318cff3bb65cd6c158616a5a53088e
SSDEEP

196608:PKQZvTYltHsI4UGhqlu5vdRYtM/FVjdFibMTJd8854qB:H9YPsI4fhfYaHjdFLiK

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
652	7105772ce15ee52a37672f39ee767e05.bin.exe
652	7105772ce15ee52a37672f39ee767e05.bin.exe

C:\Users\Admin\AppData\Local\Temp\7105772ce15ee52a37672f39ee767e05.bin.exe
"C:\Users\Admin\AppData\Local\Temp\7105772ce15ee52a37672f39ee767e05.bin.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:652

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/652-133-0x00007FFC78170000-0x00007FFC78172000-memory.dmp

Filesize
8KB

Download
memory/652-134-0x00007FF6D42E0000-0x00007FF6D56F8000-memory.dmp

Filesize
20.1MB

Download