12a202ebe5065c2c94f449ee39d0549b82366a01f99169cae3ebd3946b3c6940 | Triage

Analysis

max time kernel
133s
max time network
146s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/04/2023, 15:39

Sharing

Report Analysis Logs

General

Target

bd1f19c4defecdd38c2c366e24154ebb.exe
Size

28KB
MD5

bd1f19c4defecdd38c2c366e24154ebb
SHA1

b1be7a66fc5bd7c3c1c015fcaa8efeb37c905817
SHA256

12a202ebe5065c2c94f449ee39d0549b82366a01f99169cae3ebd3946b3c6940
SHA512

f72460bdfb4de4ab9bfffa95c916348505733ec683df11d65a2daa05efbf64fe7c537f59cfd992bab7c396159bd809fa8f1d902e919d9cccf9d12d502cd4b33b
SSDEEP

384:qXRb1oPR8JdN5wo6GBde64p9eKtlvQI/Ygr3q7MVbgORPpbamJZpTJXVbHny5PCp:qEuJTuovOvT/Ygr3q7MVsOnbbBrF

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\bd1f19c4defecdd38c2c366e24154ebb.exe
"C:\Users\Admin\AppData\Local\Temp\bd1f19c4defecdd38c2c366e24154ebb.exe"
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1996-55-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download