ecef465a5a60acb69ea5e4017dfe44d441d0127ef958686af8ccca48eae0e135

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/08/2023, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

13.9MB
MD5

93a4e8e9adf632c0d8a16f4b47418803
SHA1

24be78227a11ecfbd14c84f8881cc4d26422bfe9
SHA256

ecef465a5a60acb69ea5e4017dfe44d441d0127ef958686af8ccca48eae0e135
SHA512

7f6d41cf73bbbecb312ea85e06ab56bc9d54fcbb58ef3a68e0c16600284d6e810e029ef6f17970cd3732bcef5bd88566d808d407c54bd874df3f6092b6c1a620
SSDEEP

98304:54lMBZSJhkA12mCZkzc/kE1/4X3MWU2mvcnA:52eZSHkALfzcleX3Md

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2612	2468	tmp.exe	28
PID 2468 wrote to memory of 2612	2468	tmp.exe	28
PID 2468 wrote to memory of 2612	2468	tmp.exe	28
PID 2612 wrote to memory of 2260	2612	cmd.exe	30
PID 2612 wrote to memory of 2260	2612	cmd.exe	30
PID 2612 wrote to memory of 2260	2612	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 0
    3⤵
    PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-53-0x00000000000B0000-0x0000000000EFD000-memory.dmp

Filesize
14.3MB

Download