63678e5b056502414873fda9239cc3a24b3156e49368c4353a23324048ee1fbf

Analysis

max time kernel
68s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/06/2023, 23:28

Target

4f6f22b1e21fcb1b48bb34c2f430246d873c7f211a03f3e83d24a560d0ff1a37.exe
Size

337KB
MD5

0f9bdd25ddc56c88d02fd317d2bbfd61
SHA1

63128255a92b7b86e57c7d20deae7754dc28e50c
SHA256

4f6f22b1e21fcb1b48bb34c2f430246d873c7f211a03f3e83d24a560d0ff1a37
SHA512

6b4874ff5939e29dff0c0f3891d2b2210b52a2104fdd1cd6ea1e44c44d34b7dc8c3530e3990c9192e07478130351ada2e0e0382b1eeaf8e40e56d7b889695c7d
SSDEEP

6144:KbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihk:KQtqB5urTIoYWBQkL

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1708	4f6f22b1e21fcb1b48bb34c2f430246d873c7f211a03f3e83d24a560d0ff1a37.exe

C:\Users\Admin\AppData\Local\Temp\4f6f22b1e21fcb1b48bb34c2f430246d873c7f211a03f3e83d24a560d0ff1a37.exe
"C:\Users\Admin\AppData\Local\Temp\4f6f22b1e21fcb1b48bb34c2f430246d873c7f211a03f3e83d24a560d0ff1a37.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1708

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact