a5aa512bb59afc5126490779d0dc6be737cb35d8d2f2d387612dc36a7175957d | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/05/2023, 11:58

Sharing

Report Analysis Logs

General

Target

a5aa512bb59afc5126490779d0dc6be737cb35d8d2f2d387612dc36a7175957d.exe
Size

239KB
MD5

e5812f186043be0dd447f70dd2673beb
SHA1

92ac32fac5660ad5ab9dd198b9403a8d54508ec9
SHA256

a5aa512bb59afc5126490779d0dc6be737cb35d8d2f2d387612dc36a7175957d
SHA512

a07fe96eaebf3aabb69f295013ed402a941fbbda277a6f0227b050476de277f8305761de2afeb1405dd1f9c2d56728de217dae26c2788ec928c54ab516ea6e1f
SSDEEP

3072:0cbSBAyBuQL25e/1xRbG3Q5RZlnTNKZ1SKZoweu+H/+88veTJBMpSJsicukg4mt6:0cFyDTGoweuk2byB4SGi0mt7WsjK5j

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\a5aa512bb59afc5126490779d0dc6be737cb35d8d2f2d387612dc36a7175957d.exe
"C:\Users\Admin\AppData\Local\Temp\a5aa512bb59afc5126490779d0dc6be737cb35d8d2f2d387612dc36a7175957d.exe"
1⤵
PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-54-0x00000000005F0000-0x0000000000611000-memory.dmp

Filesize
132KB

Download
memory/832-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/832-56-0x00000000005F0000-0x0000000000611000-memory.dmp

Filesize
132KB

Download